Edit tour

Windows Analysis Report
https://booking.com-find-book.com/p/6797383828

Overview

General Information

Sample URL:	https://booking.com-find-book.com/p/6797383828
Analysis ID:	1375040
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2460 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,16912180351865998233,6883049137768924135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3948 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.com-find-book.com/p/6797383828 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://booking.com-find-book.com/p/6797383828	Avira URL Cloud: detection malicious, Label: phishing
Source: https://booking.com-find-book.com/p/6797383828	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	HTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1060768846?random=1705360583869&cv=11&fst=1705360583869&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr...	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://tr.snapchat.com/cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f	HTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1060768846?random=1705360597923&cv=11&fst=1705360597923&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr...	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=3khr2lf4oy09	HTTP Parser: No favicon
Source: https://38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni	HTTP Parser: No favicon
Source: https://join.booking.com/?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b5d1abbbd&utm_medium=frontend&utm_source=topbar	HTTP Parser: No favicon
Source: https://fledge.us.criteo.com/interest-group?data=WTN--XxscmpyMlFMTy9iZXFqVDhHdXBoKzQyT2ppK1J1N29kd09xaDY2TzZvREtJOVdFMzlYNDkvNExrYi9NR1ZsdDZRa3VmVG9yL1kwQWtadGI3Qm1hOEcrb1VGVHUyTmlpZkkySFdoSTdFWWJsNWljak96ZzZGYnMwbURiWDZ1VThzY3w	HTTP Parser: No favicon
Source: https://11963210.fls.doubleclick.net/activityi;dc_pre=CICOv7fD4IMDFZMKTwgd1vwIQA;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=460620828.1705360583;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar?	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49856 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.45.212:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.45.212:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49856 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.45.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26
Source: unknown	TCP traffic detected without corresponding DNS query: 3.231.143.26

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/6797383828 HTTP/1.1Host: booking.com-find-book.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: booking.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.booking.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/core-deps-inlinedet_cloudfront_sd/65bb6e0c1caef9acc68156912864de9c2c826461.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main_cloudfront_sd/d28523665f62421e5c65b8c6fc6848b561f4e4a2.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/index_cloudfront_sd/331a3004219803fef71cbd62c4678669e7e692e4.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/dc32f6b7.3591890c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/18cad957.5bf0bb6a.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b68fe5777bddce07972ac30ae28ab8b8f2&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22ddb81a8d5ed73135330e426f8d2b9629&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e0b261f88de846c23d3bf5693de202238&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKxsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2373fb877f2b10681ae8abbb7a0c63613&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2 HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKxsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605681 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b68fe5777bddce07972ac30ae28ab8b8f2&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.b1e38981.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/dc32f6b7.e488df59.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.f0866eea.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.00d32fb1.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22ddb81a8d5ed73135330e426f8d2b9629&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e0b261f88de846c23d3bf5693de202238&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2373fb877f2b10681ae8abbb7a0c63613&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/18cad957.c8e7c8d3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.edge.sdk.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.9e2adf90.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/client.923775ce.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gsi/client HTTP/1.1Host: accounts.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/0a098284.3c62999d.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605681 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/eb60141d.11bec58c.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/a6a21c13.3e4975b8.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy-consents/implicit HTTP/1.1Host: account.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6IjE0ZDVmN2NjLTllNmMtNDgzNi04YzkzLWIxNDVjMTgyZGE0MSJ9fQ; bkng_sso_ses=e30
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/43e47265.bbef290e.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4e596c2c.b4b42785.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/21928fd5.17ce1306.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&_u=aGBAgAIJAAAAAGgMIAC~&z=1118050036 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&gjid=1707741665&_gid=1111547412.1705360577&_u=aGBAgAIJAAAAAGgMIAC~&z=1566906621 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/53a8d0d3.088af158.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/cfbdd235.aa2e272b.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/media/world-map.7d457a5d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&_u=aGBAgAIJAAAAAGgMIAC~&z=1118050036 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/media/world-map.7d457a5d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "4066f4e0b6c463342177866cfb14bcfe"If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1fe97ff079513bb667876c67c4aa952f"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976884.jpg?k=00a3546794e9e8cbb86b98371056949ee731002b76358467601e85a0b09dd6db&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/b9a82cb8.4f94b8d4.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BEsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D
Source: global traffic	HTTP traffic detected: GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/searchresults_cloudfront_sd.iq_ltr/a1d6f1ae66ba2355300f85f32baadeeae31a7131.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchresults_cloudfront_sd/900b3ff8dac9efe90aa71448ed3ad5600b5ab5b1.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360575042 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /gsi/style HTTP/1.1Host: accounts.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 22b7de70070b66a71431259564d59756.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ct/core.js HTTP/1.1Host: s.pinimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scevent.min.js HTTP/1.1Host: sc-static.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/988382855/?random=1705360583484&cv=11&fst=1705360583484&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/600x600/976884.jpg?k=00a3546794e9e8cbb86b98371056949ee731002b76358467601e85a0b09dd6db&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BEX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-3
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/?random=1705360583869&cv=11&fst=1705360583869&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360583943&cv=11&fst=1705360583943&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360581642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&_fplc=0&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=1523317164.1705360584&sst.gcd=11l1l1l1l5&sst.tft=1705360581642&_s=1&sid=1705360585&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=19904&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBI9EWd%2FKX1FgSFzfvOkDh0pDzLXxgZmKKMqR7KWwaCperLYAX3pziKYv5YusxMTaEuxQBjhkyfADzPutztf3Dg%2FrCZuOWvzZuqADhmspcKjFqj2C9M2W%2F7Khui1rAX6vmRqV2pyVJcZVR6pHyl%2Fm5gD0FOUQNgcMLY%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360584011&cv=11&fst=1705360584011&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360584036&cv=11&fst=1705360584036&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360584157&cv=11&fst=1705360584157&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /ct/lib/main.43c0095c.js HTTP/1.1Host: s.pinimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1705360583484&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_xliVs_MDyw-B6DZ1oXHSkYdYBWCxlg&random=2826677896&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=d7cca39c07340212&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86E4lsRasrb6ehFk/WxxWJbx6fHaCyOgGrR+Rhwa4NYFrsFm8k+wPCuZNRasJjscYTwXW1b58qLiVUnDe9Jn; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=1523317164.1705360584&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BEX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLo
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=996245b2-90e2-4786-a13b-818ee45c913d&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=884839914 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|2&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKxsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqj
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=ybylZdS2LP25oPMPl9SGwAY&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nygbtVC6gzGCQmlO3hrw4g-KmzeWNhN8p48&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUnE2C_KI4ee1ZVnf5w375y3YjNd3Nvw4PC_ZdMetXCqJgw9McDzSi-VrpqD
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1705360586991&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360586999&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=visitation&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=996245b2-90e2-4786-a13b-818ee45c913d&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=358383407 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2C
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20728&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=b4835f3e-f59e-4a99-a3c2-6f7565a3736a&ts=1705360586267&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gampad/ads?pvsid=1309977198800880&correlator=373666712671362&eid=31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D13b0a081-088a-4209-9757-61298c44974b%26affiliate_id%3D304142%26rendered_ad_pageview_id%3Dd7cca39c07340212%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie_enabled=1&abxe=1&dt=1705360582423&lmt=1705360582&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360582&ga_hid=273011141&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360568635&idt=8822&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1172277823&frm=20 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20730&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=64c0dc5d-700a-4844-a35b-ecd5b1805a50&ts=1705360586269&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1705360583869&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Ap_SPNf2SGelSq6yDZ5n29CFuxtgwUjlZgmKE0Vrz-dfIUb2&random=3730487843&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360583943&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJkdp08dF56vb2yMr78z82SLuNqXlT16Sb9kMIyTl32QInD1&random=152987097&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /ct.html HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360584011&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJJA0B8mwh_FiA7A2bDQpEqb-Y1IxSI-ZbbS-fjpIZYKQy3W&random=1176934799&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360584036&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_JxYHjTeaGMCein85ILwo78MPCfdpKTootOlECM7PTT9XNEQu&random=2596020956&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg&is_vtc=1&ocp_id=ybylZdS2LP25oPMPl9SGwAY&cid=CAQSKQAvHhf_6MyPeivjXG9NQFiUHvFpiH-bdHK0pXPJOVzHVDhkBUZ_CIUy&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nyjkNN3DKD3Ik-v9lvBOTd6pcmKXvc6N2K4&random=3129231315 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360587004 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360584157&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_vL5iYH-X3Lfm-v4DQtUD5Qk1hGiiEYHtlL5rF7kIligLe8It&random=3186995343&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360587815&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /scevent.min.js HTTP/1.1Host: sc-static.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://tr.snapchat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-AB=dc4e3509882e40c68a170453af779220
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /js/bg/0Cqmw64vVDdXjGZEoSN2NjFc6s-AADeaJ1f3yoXUl2A.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4iAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4iAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /cm/s?bt=1d53c387&pnid=140&cb=1705360589537&u_scsid=a07a2f88-949f-4262-a700-8aa298b10549&u_sclid=a450d900-cc30-455d-b706-0e1ea9752a68 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://tr.snapchat.com/cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8fAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAA3KyREAIAgEsIqYWdBVLEc8qqB4zTsjLuiocngh1UmZYx0xj6m2tvawTO1gaT964gH59sCXMgAAAA==
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1705040131734%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1Host: pixel.tapad.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://tr.snapchat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPI
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=d7cca39c07340212&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010T
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360581642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&_fplc=0&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=1523317164.1705360584&sst.gcd=11l1l1l1l5&sst.tft=1705360581642&_s=1&sid=1705360585&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=19904&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1705360583484&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_xliVs_MDyw-B6DZ1oXHSkYdYBWCxlg&random=2826677896&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|2&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1705360586991&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1705360583869&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Ap_SPNf2SGelSq6yDZ5n29CFuxtgwUjlZgmKE0Vrz-dfIUb2&random=3730487843&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360583943&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJkdp08dF56vb2yMr78z82SLuNqXlT16Sb9kMIyTl32QInD1&random=152987097&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360586999&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360587815&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360587004 HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20728&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=b4835f3e-f59e-4a99-a3c2-6f7565a3736a&ts=1705360586267&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360584036&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_JxYHjTeaGMCein85ILwo78MPCfdpKTootOlECM7PTT9XNEQu&random=2596020956&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20730&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=64c0dc5d-700a-4844-a35b-ecd5b1805a50&ts=1705360586269&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360584011&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJJA0B8mwh_FiA7A2bDQpEqb-Y1IxSI-ZbbS-fjpIZYKQy3W&random=1176934799&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg&is_vtc=1&ocp_id=ybylZdS2LP25oPMPl9SGwAY&cid=CAQSKQAvHhf_6MyPeivjXG9NQFiUHvFpiH-bdHK0pXPJOVzHVDhkBUZ_CIUy&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nyjkNN3DKD3Ik-v9lvBOTd6pcmKXvc6N2K4&random=3129231315 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360584157&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_vL5iYH-X3Lfm-v4DQtUD5Qk1hGiiEYHtlL5rF7kIligLe8It&random=3186995343&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhR
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|9482,js_web_vitals_fid_ms\|3&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKxsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: d7cca39c07340212X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_a
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|9482,js_web_vitals_fid_ms\|3&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzP
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "65adf2d4363bba13d63bbc403b0b3cce"If-Modified-Since: Mon, 15 Jan 2024 13:45:30 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "4066f4e0b6c463342177866cfb14bcfe"If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
Source: global traffic	HTTP traffic detected: GET /js_errors HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1fe97ff079513bb667876c67c4aa952f"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/client.923775ce.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "a4618794d329c0c74897c7e2128aa1cc"If-Modified-Since: Mon, 15 Jan 2024 08:33:15 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "3dea702266bc3a577d7141f2e79259db"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/eb60141d.11bec58c.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "ce1b060a535136eefe1c7d1a63051046"If-Modified-Since: Fri, 12 Jan 2024 13:21:43 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "449f8abd0585d68506a1e46ad4a8bbad"If-Modified-Since: Mon, 15 Jan 2024 20:10:57 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "eefe1bd68506ecbaf7afcee3ddccc7e4"If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/a6a21c13.3e4975b8.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6c724cb3ab9cbeccff5d0251367f5e7d"If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "b784a10f3e0a67de1f039c5da9307d34"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "90af4f7d03acdf40d8242f30e2fb0a85"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "a49908dd31f3e4bd429d8384882c9cd8"If-Modified-Since: Fri, 12 Jan 2024 09:30:42 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8d340c5f9230be5b10b1f59d2a17b65b"If-Modified-Since: Mon, 15 Jan 2024 08:33:14 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e8acd113d90ead00a8a9f3cf0530ceca"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuV
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-Modified-Since: Mon, 15 Jan 2024 23:16:18 +0000
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6ea
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Exsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; _ga=GA1.2.810723182.1705360577; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605931 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A33+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmK
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|2531&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; lastSeen=1705360596429; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D
Source: global traffic	HTTP traffic detected: GET /static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360594846 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605931 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|2531&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXH
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9ExX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d;
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 0bc83a5be386a6200edf12c709bbfe62.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/988382855/?random=1705360597783&cv=11&fst=1705360597783&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/?random=1705360597923&cv=11&fst=1705360597923&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source;navigation-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360597967&cv=11&fst=1705360597967&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360598000&cv=11&fst=1705360598000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360598042&cv=11&fst=1705360598042&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360598079&cv=11&fst=1705360598079&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=124265061.1705360598&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=124265061.1705360598&sst.gcd=11l1l1l1l5&sst.tft=1705360596915&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=6130&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=826270f9-62fe-4a6d-be16-94d618ec54f0&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=2768&m_fcps=2531&m_pi=2714&m_pl=4615&m_pv=2&m_rd=6224&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=8cdddd56-5cf7-41c3-af77-7a029b3c4e56&ts=1705360598553&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=3khr2lf4oy09 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360598749&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360598751&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9ExX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_O0wv-8htkv-ARseb33UWk-d3xF53EJOcaQOJvH0r1TdXdMmt&random=2158629236 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /gampad/ads?pvsid=1277477425375320&correlator=972839179899800&eid=31079956%2C31080295%2C31080441%2C31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3Df026c47f-f6c4-460b-93fa-1f2190c83402%26affiliate_id%3D304142%26rendered_ad_pageview_id%3D7ceca3a89c6d001e%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3Df927aa320290b431%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ&gpic=UID%3D00000db788c26b0e%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA&abxe=1&dt=1705360597396&lmt=1705360597&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=124&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360597&ga_hid=1177479985&ga_fc=true&ga_cid=1111547412.1705360577&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360593187&idt=773&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1126437992&frm=20 HTTP/1.1Host: securepubads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1705360597783&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_i197d509oLaI9ZobWyNTHpi9mBZMhBCuj3xzghHEWlEbvJ8N&random=4115807802&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1705360597923&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_fupSUXTRqaTLl3HIjS40PJucnnu-JQRD_0-RDLxHwytskKyq&random=508482912&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=7ceca3a89c6d001e&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqv
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360597967&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_k3ZKH6DjHbnIcFRKtJhH8uKkOqptOjvw_cfeueeFL7efLagg&random=599786722&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360598000&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0hVuuTBfVjc5kWuiD6e2QNxDfNowOiQySAeWQCJYFtu9LAv9&random=3970838727&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360598042&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_C6dkLDIEgTr3RTf_2TVnFzs80O94zc7a39hyjaqYJl-D_6MN&random=1991363687&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360598780 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360598079&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gGlxjONdeyxb5OSeeKxPtSTDvscDhWgGEq83Cm0-EZsG__B3&random=714141179&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=826270f9-62fe-4a6d-be16-94d618ec54f0&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=2768&m_fcps=2531&m_pi=2714&m_pl=4615&m_pv=2&m_rd=6224&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=8cdddd56-5cf7-41c3-af77-7a029b3c4e56&ts=1705360598553&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360598749&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360598751&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=124265061.1705360598&sst.gcd=11l1l1l1l5&sst.tft=1705360596915&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=6130&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/689588.jpg?k=67d1fdb867d74cdd3a5c6adc2558ff14c165b55329efec5109e5cbea8743aa6c&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=25&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=8a4dc4d9-ff21-469d-b3c5-da728db6e3e4&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=1744799861 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTB
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360599275&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOsi71E01M7sI5kkwBUNhACamyxTR6Rm03NGDvccpS3RN9M9WBwRiIU3ixcUzTo8W6WcbbsA0elSWCGGp%2Fhl2uYgYpSZY5lhgAeOtvxgedcNvXBjvN1Nz55QMbZ803yqWWCvQCfnXPKhEQPElk08YB6%2Bo%3D; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_O0wv-8htkv-ARseb33UWk-d3xF53EJOcaQOJvH0r1TdXdMmt&random=2158629236 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=7ceca3a89c6d001e&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360598780 HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZtc1h4dW5uTVZxVzFFRCs3eVJETEI1WEw0Ykd3V3YzWnJCQ2drdlY1THlqS0NDL0JCdzh0VU5LLzRDTDRtMHRYNWg5bTlkTmJoY1E5bXdwTkJGblpmN1h5bS9ubk8rVEVtVmF0RjNOekhzcz0mMG1zMzNMMEtySjh2OU90bFZQM3ZtaHBuZS84PQ=="
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1705360597783&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_i197d509oLaI9ZobWyNTHpi9mBZMhBCuj3xzghHEWlEbvJ8N&random=4115807802&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/689588.jpg?k=67d1fdb867d74cdd3a5c6adc2558ff14c165b55329efec5109e5cbea8743aa6c&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1705360597923&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_fupSUXTRqaTLl3HIjS40PJucnnu-JQRD_0-RDLxHwytskKyq&random=508482912&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360597967&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_k3ZKH6DjHbnIcFRKtJhH8uKkOqptOjvw_cfeueeFL7efLagg&random=599786722&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360598000&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0hVuuTBfVjc5kWuiD6e2QNxDfNowOiQySAeWQCJYFtu9LAv9&random=3970838727&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360598042&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_C6dkLDIEgTr3RTf_2TVnFzs80O94zc7a39hyjaqYJl-D_6MN&random=1991363687&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 7ceca3a89c6d001eX-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqj
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360598079&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gGlxjONdeyxb5OSeeKxPtSTDvscDhWgGEq83Cm0-EZsG__B3&random=714141179&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "65adf2d4363bba13d63bbc403b0b3cce"If-Modified-Since: Mon, 15 Jan 2024 13:45:30 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360599275&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZtc1h4dW5uTVZxVzFFRCs3eVJETEI1WEw0Ykd3V3YzWnJCQ2drdlY1THlqS0NDL0JCdzh0VU5LLzRDTDRtMHRYNWg5bTlkTmJoY1E5bXdwTkJGblpmN1h5bS9ubk8rVEVtVmF0RjNOekhzcz0mMG1zMzNMMEtySjh2OU90bFZQM3ZtaHBuZS84PQ=="
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "4066f4e0b6c463342177866cfb14bcfe"If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1fe97ff079513bb667876c67c4aa952f"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/client.923775ce.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "a4618794d329c0c74897c7e2128aa1cc"If-Modified-Since: Mon, 15 Jan 2024 08:33:15 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "3dea702266bc3a577d7141f2e79259db"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "449f8abd0585d68506a1e46ad4a8bbad"If-Modified-Since: Mon, 15 Jan 2024 20:10:57 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "eefe1bd68506ecbaf7afcee3ddccc7e4"If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "b784a10f3e0a67de1f039c5da9307d34"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "90af4f7d03acdf40d8242f30e2fb0a85"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053606001 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "a49908dd31f3e4bd429d8384882c9cd8"If-Modified-Since: Fri, 12 Jan 2024 09:30:42 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8d340c5f9230be5b10b1f59d2a17b65b"If-Modified-Since: Mon, 15 Jan 2024 08:33:14 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e8acd113d90ead00a8a9f3cf0530ceca"If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUbsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRF
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-Modified-Since: Mon, 15 Jan 2024 23:16:18 +0000
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W4pr5w8Bwn9gc2YaU9JhVqFRemYlePujGaqxLdjxKjY%2FCl2fxJOW0gPlw6FqzKsmVVe2gwdTDLgoFXJB5MReygNNY3uNaG9KRjqHknoUXKzgRo9zioNxnZd7rhwsdTDBteexGJeQw25uYAAml6urOavWgXrlbFvHY%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "4066f4e0b6c463342177866cfb14bcfe"If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1fe97ff079513bb667876c67c4aa952f"If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUbsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiM
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingRecon
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3006&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUbsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360602797 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/988382855/?random=1705360607644&cv=11&fst=1705360607644&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/?random=1705360607860&cv=11&fst=1705360607860&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360607901&cv=11&fst=1705360607901&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/973712236/?random=1705360607937&cv=11&fst=1705360607937&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360607982&cv=11&fst=1705360607982&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BRtKHnxHt2mRW%2B%2BAOT5uI%2BlK1nabE0AFD%2BathnduIOfsy6D3EJLONgVSUF1dzZf6t7rOMdlhmZqjsf7WOb5p8hvM9pE6co%2FvGOKc0Mcl%2FqGmQGn8uDIc2PTVog54Iwa4MS1SYcgXi%2FAvc7C8eKLaqgzGZr%2BuOCEIM%3D
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360606642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=50931350.1705360608&sst.gcd=11l1l1l1l5&sst.tft=1705360606642&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8521&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1u
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/975716499/?random=1705360608028&cv=11&fst=1705360608028&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360608473&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=1a065792-be81-49f6-b178-47e74a8775d1&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=3329&m_fcps=3006&m_pi=3312&m_pl=6960&m_pv=2&m_rd=8599&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&trackId=2cfd8eee-8e7d-4b46-a553-5748470cbd20&ts=1705360608302&v=3.8.0-2401042024 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360608474&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-8
Source: global traffic	HTTP traffic detected: GET /activeview/js/current/ufs_web_display.js?cache=r20110914 HTTP/1.1Host: www.googletagservices.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=50931350.1705360608&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_IIz2dK4FKIiOPT1_TLlWCJh110njpmcKCcLaLfAgEwoSW5mM&random=246440793 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360608552 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1705360607644&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZYNBEMPIrA4HrSoXQRak8eVNRjEZFwy2XdfHFzpIgHMySXsA&random=825179981&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=f667a3ac68470510&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1705360607860&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_J8dQ19nhGyvWNr45DULlOEUF2EILMmfQIlWNIQk6BYSaIomx&random=3820176364&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360607901&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_3_cmDTS6kBH18CikhtE2wR7f3jd-lCUKV-yZpnqyl1fnNZHS&random=2600041176&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1705360607937&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Fi636anKBXpCOS77ajXhwCig1tEr1GRkc0CPKwqLRhck4F8G&random=4885263&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053606001 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; lastSeen=1705360609643
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360607982&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZNtCHK4WSUyPlt65YjyJIGPKlUPsYbV0cbaC5ylbAyBog22y&random=2403716807&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlP
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360609076&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; lastSeen=1705360609643
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1705360608028&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_skkIMrKrw64NPaZLdqxbfgN8fxv98XASgUy2qZDzVc3AA1y7&random=237176101&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbdsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d;
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUbsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AE
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=32&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=2f16f2b4-9344-4d1f-8f1c-d915a14c4311&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2Findex.html&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=1575297318 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbdAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|8\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUbsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: f667a3ac68470510X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cbsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oBOAAAA:K1cD8q3nfqHU0ro8guwgShcOobm64TKyY17S99e80Ck7Js8RVQy0HZIFgwfAFyiqj7J0zGUWElTxrJ8P2B+q6NzpoeK8QsrlSyuWaoRMFumzBr96xRYYDFipd8PZpvvppxf5h7/ydAXG0YTycLC2KVJ3t0jaRWCppvIvk57Lmgd7xuCfh/RR0UW6zMawW0/DYVvOCS/eeNA3sFuiRf+Q52AiNAbzApWFRNL6ehbE9Eih4SnldTdcXMQqWjrSeBGHFBch+zfG
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oB
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3006&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_370.2.dr	String found in binary or memory: href="https://www.linkedin.com/showcase/googlemarketingplatform" equals www.linkedin.com (Linkedin)
Source: chromecache_370.2.dr	String found in binary or memory: href="https://www.youtube.com/c/googlemarketingplatform" equals www.youtube.com (Youtube)
Source: chromecache_370.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.facebook.com (Facebook)
Source: chromecache_370.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.linkedin.com (Linkedin)
Source: chromecache_370.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.twitter.com (Twitter)
Source: chromecache_370.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.youtube.com (Youtube)
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: "https://www.facebook.com/bookingcom/", equals www.facebook.com (Facebook)
Source: chromecache_322.2.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cf.bstatic.com/static/js/pega_cloudfront_sd/632057f4cc4f9dcc5b9cb8662e00c014a2c732e1.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://sc-static.net/scevent.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s.pinimg.com/ct/lib/main.c6ca189a.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.facebook.com/tr","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://ct.pinterest.com/v3/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://pega.booking.com/prweb/app/default/","CategoryId":["C0004"],"Vendor":null}]'), equals www.facebook.com (Facebook)
Source: chromecache_631.2.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://www.googletagmanager.com/gtm.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/index.c13da051f98426846756.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://join.booking.com/error_catcher","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://dynamic.criteo.com/js/ld/ld.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/index.f4086bc87bcfe437f4ed.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/seo.ed37a281cfb094ac29e8.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/seo.9ffaf7bc74ed2c961982.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/1348744405183611","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/seo.d3bac442425137fb6f88.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/capla/static/js/client.70e6acca.js","CategoryId":["C0004"],"Vendor":null}]'), equals www.facebook.com (Facebook)
Source: chromecache_443.2.dr, chromecache_338.2.dr, chromecache_471.2.dr, chromecache_348.2.dr	String found in binary or memory: return b}DC.D="internal.enableAutoEventOnTimer";var xc=ca(["data-gtm-yt-inspected-"]),EC=["www.youtube.com","www.youtube-nocookie.com"],FC,GC=!1; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 134Content-Type: text/html; charset=UTF-8Date: Mon, 15 Jan 2024 23:16:31 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: chromecache_625.2.dr	String found in binary or memory: http://benalman.com/about/license/
Source: chromecache_625.2.dr	String found in binary or memory: http://benalman.com/projects/jquery-hashchange-plugin/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://cars.booking.com/Home.do?affiliateCode=booking-com&adplat=footer&preflang=en
Source: chromecache_601.2.dr	String found in binary or memory: http://github.com/jrburke/almond
Source: chromecache_625.2.dr	String found in binary or memory: http://josscrowcroft.github.com/accounting.js/
Source: chromecache_475.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_475.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_575.2.dr	String found in binary or memory: http://leafo.net
Source: chromecache_575.2.dr	String found in binary or memory: http://mbostock.github.com/protovis/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://ogp.me/ns#
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://ogp.me/ns/fb/booking_com#
Source: chromecache_626.2.dr, chromecache_370.2.dr, chromecache_342.2.dr	String found in binary or memory: http://schema.org
Source: chromecache_475.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_556.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_702.2.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_575.2.dr	String found in binary or memory: http://www.lokeshdhakar.com
Source: chromecache_575.2.dr	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: chromecache_575.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: http://www.opentable.com?ref=16087
Source: chromecache_370.2.dr	String found in binary or memory: https://about.google/
Source: chromecache_370.2.dr	String found in binary or memory: https://about.google/commitments/racialequity/
Source: chromecache_370.2.dr	String found in binary or memory: https://about.google/products/
Source: chromecache_342.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?dt=1705360593&client_id=vO1Kblk7xX9tUn2cpZLS&respons
Source: chromecache_626.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?response_type=sso&state=UpEDXk7utcQPMgCcWdwfs5YFD5WnmAec
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://account.booking.com/oauth2/authorize?aid=304142;client_id=d1cDdLj40ACItEtxJLTo;redirect_uri=
Source: chromecache_450.2.dr	String found in binary or memory: https://account.booking.com/oauth2/authorize?redirect_uri=https%3A%2F%2Fjoin.booking.com%2Faccount.h
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://account.booking.com/sso/logout/v3
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/button
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcm.json
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcmcsp?client_id=
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/iframe/select
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/log
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/revoke
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/select
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/status
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/gsi/style
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_513.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/v2/auth
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://ad.doubleclick.net/activity;
Source: chromecache_471.2.dr	String found in binary or memory: https://ad.doubleclick.net/activity;register_conversion=1;
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity/
Source: chromecache_370.2.dr	String found in binary or memory: https://admanager.google.com/home/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://admin.booking.com/?lang=xu&utm_source=extranet_login_footer&utm_medium=frontend&utm_campaign
Source: chromecache_450.2.dr	String found in binary or memory: https://admin.booking.com/hotel/hoteladmin/?lang=xu
Source: chromecache_370.2.dr	String found in binary or memory: https://ads.google.com/home/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark
Source: chromecache_370.2.dr	String found in binary or memory: https://adsense.google.com/start/?subid=ww-en-et-ads-ot-a-marketing_platform
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_370.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-animate.min.js
Source: chromecache_370.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-touch.min.js
Source: chromecache_370.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular.min.js
Source: chromecache_652.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_370.2.dr	String found in binary or memory: https://analytics.google.com/analytics/academy/?utm_source=marketingplatform.google.com&utm_medium=e
Source: chromecache_450.2.dr	String found in binary or memory: https://booking.com/?lang=xu
Source: chromecache_626.2.dr	String found in binary or memory: https://booking.com/articles.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAEx
Source: chromecache_342.2.dr	String found in binary or memory: https://booking.com/articles.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AE
Source: chromecache_626.2.dr	String found in binary or memory: https://booking.com/pxgo?lang=en&token=UmFuZG9tSVYkc2RlIyh9YY_oTPIGnIwxsTOANoogQKFcQXg4XYPICgANCPNBH
Source: chromecache_342.2.dr	String found in binary or memory: https://booking.com/pxgo?lang=en&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fa%3Dbdc%252Ffooter_link%
Source: chromecache_626.2.dr	String found in binary or memory: https://business.booking.com/?aid=304142&lang=en-us&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAE
Source: chromecache_342.2.dr	String found in binary or memory: https://business.booking.com/?lang=en-us&aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAE
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://careers.booking.com/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://careers.booking.com/?utm_source=corporate&utm_medium=footer
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://carrier.booking.com/google/places/webautocompletesimple
Source: chromecache_443.2.dr, chromecache_338.2.dr, chromecache_471.2.dr, chromecache_348.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_450.2.dr	String found in binary or memory: https://cdn.cookielaw.org/consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/OtAutoBlock.js
Source: chromecache_450.2.dr	String found in binary or memory: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/images/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js
Source: chromecache_450.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/18cad957.5bf0bb6a.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/21928fd5.c540d700.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/3d066b0d.e1874fca.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/43e47265.9fb0fb7a.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css
Source: chromecache_450.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/4ff72d09.17169d33.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/53a8d0d3.b1818b84.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/7bcb015e.5b709f3d.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/8207c303.462834bc.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/a6a21c13.8939445f.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/c6a78acb.bffda4a9.chunk.css
Source: chromecache_450.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/c8a2f0e8.f2766d1b.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/cfbdd235.7a595d50.chunk.css
Source: chromecache_626.2.dr, chromecache_450.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/client.c9e8f1b3.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/d2a738da.079c3b4c.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/dc32f6b7.3591890c.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css
Source: chromecache_631.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/joinapp/assets/build/index.c13da051f98426846756.js
Source: chromecache_631.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/joinapp/assets/build/index.f4086bc87bcfe437f4ed.js
Source: chromecache_631.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/joinapp/assets/build/seo.9ffaf7bc74ed2c961982.js
Source: chromecache_631.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/joinapp/assets/build/seo.d3bac442425137fb6f88.js
Source: chromecache_631.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/joinapp/assets/build/seo.ed37a281cfb094ac29e8.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/assistant_entrypoint_cloudfront_sd.iq_ltr/611b70b00745fa4412a01012
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/async_tt_quiz_cloudfront_sd.iq_ltr/ac73a1533c9b137d154e412af58b0b6
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/async_wpm_overlay_assets_cloudfront_sd.iq_ltr/abb304bf3600a5cf5f74
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a1d6f1ae66ba2355300f85f32baadee
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/ski_lp_overview_panel_cloudfront_sd.iq_ltr/2b3350935410fe4e36d74ef
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6ab
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/apple-touch-icon/5db9fd30d96b1796883ee94be7dddce50b73bb38.png
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/booking_logo_knowledge_graph/247454a990efac1952e44dddbf30c58677aa0
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/40749a316c45e239a7149b6711ea4c48d10f8d89.ico
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/4a3b40c4059be39cbf1ebaa5f97dbb7d150926b9.png
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/fb/1/8a240f547dbef4211044f4392436beda77674398.jpg
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/nobg_all_blue_iq/b700d9e3067c1186a3364012df4fe1c48ae6da44.png
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845e
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42f
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3d
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/twitter-image-else/566c7081f1deeaca39957e96365c3908f83b95af.jpg
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/assistant_entrypoint_cloudfront_sd/ef4280b820a27ed734dd50de76d082ea
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_atlas_v2_cn_cloudfront_sd/0117731bcd8255423a0d53e0c92b8939ff2
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_atlas_v2_non_cn_cloudfront_sd/7e0cbc271e29eb434b17771a00aa554
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_flash_deals_countdown_cloudfront_sd/ed6ec8a2950ae6f5f3420107a
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_index_postcards_c360_cloudfront_sd/11d2b12d25c970340e0e5c5707
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_lists_cloudfront_sd/ea653b9852a85cb0190755d3979dbd317a486979.
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_tt_quiz_cloudfront_sd/8e3159ed1f490736c8984a2b979c73d5dbf0c86
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_wpm_overlay_assets_cloudfront_sd/c6cb9b63eea61102d4e96fe72b7c
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_places_async_cloudfront_sd/c94b60c4da2dae6b55fd9eabf168f146fc
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/core-deps-inlinedet_cloudfront_sd/65bb6e0c1caef9acc68156912864de9c2
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf0
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.j
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/index_cloudfront_sd/331a3004219803fef71cbd62c4678669e7e692e4.js
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e462955
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/main_cloudfront_sd/d28523665f62421e5c65b8c6fc6848b561f4e4a2.js
Source: chromecache_322.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/pega_cloudfront_sd/632057f4cc4f9dcc5b9cb8662e00c014a2c732e1.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js
Source: chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchresults_cloudfront_sd/900b3ff8dac9efe90aa71448ed3ad5600b5ab5b
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb2
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/ski_lp_overview_panel_cloudfront_sd/9d8e7cfd33a37ffb15285d98f697002
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.j
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/xphoto/540x405/292049346.webp?k=ad53f89eb6ed386bcdb6100d5c729e6d
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b6
Source: chromecache_370.2.dr	String found in binary or memory: https://cloud.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marketi
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_500.2.dr	String found in binary or memory: https://collector-a.perimeterx.net/api/v2/collector/clientError?r=
Source: chromecache_342.2.dr	String found in binary or memory: https://community.booking.com/?profile.language=en
Source: chromecache_631.2.dr	String found in binary or memory: https://connect.facebook.net/signals/config/1348744405183611
Source: chromecache_712.2.dr	String found in binary or memory: https://ct.pinterest.com/stats/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://d8c14d4960ca.edge.sdk.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js
Source: chromecache_370.2.dr	String found in binary or memory: https://developers.google.com/ads-data-hub
Source: chromecache_370.2.dr	String found in binary or memory: https://developers.google.com/analytics/?utm_source=marketingplatform.google.com&utm_medium=et&utm_c
Source: chromecache_370.2.dr	String found in binary or memory: https://developers.google.com/doubleclick-advertisers/?utm_source=marketingplatform.google.com&utm_m
Source: chromecache_513.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#cross_origin)
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_370.2.dr	String found in binary or memory: https://developers.google.com/tag-manager/?utm_source=marketingplatform.google.com&utm_medium=et&utm
Source: chromecache_296.2.dr	String found in binary or memory: https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html
Source: chromecache_631.2.dr	String found in binary or memory: https://dynamic.criteo.com/js/ld/ld.js
Source: chromecache_370.2.dr	String found in binary or memory: https://firebase.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark
Source: chromecache_497.2.dr, chromecache_582.2.dr	String found in binary or memory: https://fledge.us.criteo.com
Source: chromecache_497.2.dr	String found in binary or memory: https://fledge.us.criteo.com/criteo.wasm
Source: chromecache_497.2.dr	String found in binary or memory: https://fledge.us.criteo.com/getvalues
Source: chromecache_497.2.dr	String found in binary or memory: https://fledge.us.criteo.com/interest-group/update?key=UICZs3xscmpyMlFMTy9iZXFqVDhHdXBoKzR4UlErM1owb
Source: chromecache_497.2.dr	String found in binary or memory: https://fledge.us.criteo.com/simplebid?platform=us
Source: chromecache_370.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015gqJrLK8.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015jKJr.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKgE0mV0Q.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKjk0m.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcQ72j00.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcg72j00.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcw72j00.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKew72j00.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfA72j00.woff2)
Source: chromecache_578.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2)
Source: chromecache_467.2.dr	String found in binary or memory: https://github.com/google/safevalues/issues
Source: chromecache_475.2.dr	String found in binary or memory: https://github.com/jquery/jquery-migrate
Source: chromecache_338.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: chromecache_575.2.dr	String found in binary or memory: https://github.com/toddmotto/echo
Source: chromecache_471.2.dr	String found in binary or memory: https://google.com/ccm/form-data/
Source: chromecache_471.2.dr	String found in binary or memory: https://google.com/pagead/form-data/
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net/
Source: chromecache_471.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/
Source: chromecache_614.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random
Source: chromecache_308.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/18cad957.5bf0bb6a.chunk.css.map
Source: chromecache_633.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/1baf5a63.539e3a8f.chunk.css.map
Source: chromecache_368.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/21928fd5.c540d700.chunk.css.map
Source: chromecache_289.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/3d066b0d.e1874fca.chunk.css.map
Source: chromecache_323.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/43e47265.9fb0fb7a.chunk.css.map
Source: chromecache_610.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/445be7a9.b944bd98.chunk.css.map
Source: chromecache_533.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/4dfc553b.202caa61.chunk.css.map
Source: chromecache_709.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/4e596c2c.3a2fb681.chunk.css.map
Source: chromecache_315.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/4ff72d09.17169d33.chunk.css.map
Source: chromecache_528.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/53a8d0d3.b1818b84.chunk.css.map
Source: chromecache_547.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/7a53cdfb.d6ed6882.chunk.css.map
Source: chromecache_453.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/7bcb015e.5b709f3d.chunk.css.map
Source: chromecache_432.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/8207c303.462834bc.chunk.css.map
Source: chromecache_415.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/a6a21c13.8939445f.chunk.css.map
Source: chromecache_663.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/b9a82cb8.c62928a4.chunk.css.map
Source: chromecache_435.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/c6a78acb.bffda4a9.chunk.css.map
Source: chromecache_304.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/c8a2f0e8.f2766d1b.chunk.css.map
Source: chromecache_412.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/cfbdd235.7a595d50.chunk.css.map
Source: chromecache_659.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/client.c9e8f1b3.css.map
Source: chromecache_457.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/client.d20f8859.css.map
Source: chromecache_632.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/d2a738da.079c3b4c.chunk.css.map
Source: chromecache_637.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/dc32f6b7.3591890c.chunk.css.map
Source: chromecache_562.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/eb60141d.cad86b29.chunk.css.map
Source: chromecache_537.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/f50a2dfc.837540b6.chunk.css.map
Source: chromecache_600.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/f5d0e2e7.a54d85eb.chunk.css.map
Source: chromecache_705.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/0a098284.3c62999d.chunk.js.map
Source: chromecache_410.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/18cad957.c8e7c8d3.chunk.js.map
Source: chromecache_577.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/1baf5a63.bda1a47c.chunk.js.map
Source: chromecache_351.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/21928fd5.17ce1306.chunk.js.map
Source: chromecache_544.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/3d066b0d.fd7d6ddf.chunk.js.map
Source: chromecache_400.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/43e47265.bbef290e.chunk.js.map
Source: chromecache_451.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/445be7a9.21674fdf.chunk.js.map
Source: chromecache_605.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4a89d2db.6c0ec4b3.chunk.js.map
Source: chromecache_698.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4dfc553b.0654ebd5.chunk.js.map
Source: chromecache_696.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4e596c2c.b4b42785.chunk.js.map
Source: chromecache_594.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4ff72d09.d3848f83.chunk.js.map
Source: chromecache_583.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/53a8d0d3.088af158.chunk.js.map
Source: chromecache_642.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/697d5684.349d4aeb.chunk.js.map
Source: chromecache_593.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/7a53cdfb.692b69e3.chunk.js.map
Source: chromecache_539.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/7bcb015e.c05167ae.chunk.js.map
Source: chromecache_288.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/8207c303.bdceabc2.chunk.js.map
Source: chromecache_672.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/926bcaf3.2af16116.chunk.js.map
Source: chromecache_332.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/a6a21c13.3e4975b8.chunk.js.map
Source: chromecache_395.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/b25f03c4.223f6b5e.chunk.js.map
Source: chromecache_561.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/b9a82cb8.4f94b8d4.chunk.js.map
Source: chromecache_350.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/c6a78acb.9b7b7bd0.chunk.js.map
Source: chromecache_673.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/c8a2f0e8.8981d2dc.chunk.js.map
Source: chromecache_428.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/cfbdd235.aa2e272b.chunk.js.map
Source: chromecache_369.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.16f4dc63.js.map
Source: chromecache_417.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.7ef6b36a.js.map
Source: chromecache_640.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.923775ce.js.map
Source: chromecache_678.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/d2a738da.b09ae90e.chunk.js.map
Source: chromecache_666.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/dc32f6b7.e488df59.chunk.js.map
Source: chromecache_455.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/eb60141d.11bec58c.chunk.js.map
Source: chromecache_347.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js.map
Source: chromecache_340.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js.map
Source: chromecache_509.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.00d32fb1.client.js.map
Source: chromecache_359.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.9e2adf90.client.js.map
Source: chromecache_291.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.b1e38981.client.js.map
Source: chromecache_559.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.f0866eea.client.js.map
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://join.booking.com/?lang=en-us&aid=304142&utm_source=footer_menu&utm_medium=fronte
Source: chromecache_631.2.dr	String found in binary or memory: https://join.booking.com/error_catcher
Source: chromecache_450.2.dr	String found in binary or memory: https://join.booking.com/faq.html?aid=304142
Source: chromecache_450.2.dr	String found in binary or memory: https://join.booking.com/index.html?aid=304142
Source: chromecache_450.2.dr	String found in binary or memory: https://join.booking.com/trust?offer=
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/0Q6D6O_H1ln-2XsHxasKU98MASf2MLcp6b0YJcH7L_6jULLHCTh3-WhICIlKXbpr-D
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/4wKdcCWNhhdCSoEVMCTzXPiD1J0FYAfAEHVfqhAzWGBE1CNhPGWOaO6lzpsai7u3bH
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/5Yi9pUyi0xjbfbdG2p4kyVsYGlDWYrbQUlaLXLAiUlmRB9I3myFxlFusUi29QGev9g
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/9Ukdk5mlaSxOFDc98fBBHg0zz_mMebexFn8WtVRRS8QqsyGzLlvL2SCoY-CAyyXY0p
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/BfyS-j_OOTMqkt4eomWru4C8MOdli_YtSaXpmkI-qdjd6cAF1Po5s5CxF6i_iFSYfh
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DJ26GEBH94yMQ3dofeAy0GTxU1JeuRSVQvfd9cxkfD4h-Yj8hpMMXKsgbToA49zQiJ
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DgLaFV6_tiByMcu1ZzxH0AbKPc8_YTveTUBJHm7dKS3lsSNbA9dWibqtXp7TJHLkpl
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DmpK8ugt7esqJ4s8hDBJRCeW_dVp40duUXRr-V4Yxvvon2ZxL-jM2Ukjyk834RQcHm
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/IaZ7OWBb5-6tf44cedpONxZuteHjRvHH8sDgPaCEGBYmD9fYII42iaUIcDUKA1DGa6
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/J1lW_pPLg0dOdxjYZ7eK61Q-Tgc0yUc0Ssp2Kdde9KHjl7iFptnFes6xVADOkzyYsn
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/LCXHdwCVFUVKVceZ7Ebxe5MnjHhCOrM5Tc1sUYiHSeF80cAZejxwYs_JoRRCDwZG4M
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/M3BEUZgVVGIo4Y9o1YaEaurfGUy3aquf87fXzlo5UnZC-iLOAQ-N1ho9u9Ywx-4Tmj
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/McJV-U6w665Cr7SFm8uBmRog_9DPfbCdntR4aK0tL2wjaXrKc0EsUT649iJOlZfVAA
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/T0P6stldNdtTJ9yCbmfQI3mgyERiFmiILsGPq2o-rbmsCCBUwGkqBZW94qiD-ldjJY
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/T0t-NlSp0OzDa4gqQgUcftzEXmWnhR6RfUDWq-8z9P_mCn9xkxqCSbsD5UiogxeoTo
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/TjCG9F-cHmWkQ9ZYIbHGWAJueckyNudq-tj6--z5E-gBYQtplStcE9dBBRXLYdWjbe
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/ToOoAIQwJV9q573oHPf0rmIGzxrYnExPpSlCMvlTtpZYddSDWUb4BS5w4vR_LoUSiQ
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/Xde_feRXsipCVqfFr7i0xr1K_OlsP_h7tfxcp3Xj0EZj78gF77vF4Lcj01B4S14zO5
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx2
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/XvcIkb0Lqs86H9rq4wocG56dgQmp7EFyIC18o1gJiMnxUJBkj7YyxUGViLIDPtB_KN
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/eBgXEvVz_cqaqw5ZZRjWndAKwLuWlFXuf9CW0NHHMgK3BY5TCrI2AE1tsq20ZeXM55
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/g1VeY9p01k-fMeY0yTPigiPXx09HBHtcK6SfGLrX_GVk1UO9zik80izCL5yecuKJqK
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/jZDSgvByFEvqdDnQR1gtUN1f86-ZbMJKLtlUshMU1Qk0c_Dzb3-NjxX-F1ZvGnEx_7
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/nJzFtXRNnCoIZXs6_v7xgf0Nz6l1X-0bKmGaJz0KTY3ovil-DDcimGKPyhkoEEONab
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/rIhH9x08DxI4YdYl9hB-MmC4e1MFaovevyo98RHu3ryszkuwXCkSYxgKD2-8btnf4x
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/secXuOC5WcxmNqaaKKhyAEU1GiiW8kg5Eh1SB-8jrhyrVLb_VWA0NIgNlwKhtaW8y9
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/uu1BWN2_yiSe1Ciw4nsEQ2gTDIzIOpTATkeVuPLijgZvHQxmJcjfF1RQJNmgb7VaJ_
Source: chromecache_370.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/wrHKPwn_RKCusdpmICnKeZoYVzfup5x3e6UFj58iVzEymAnru1XWjhrl2mFu5eLJ8X
Source: chromecache_370.2.dr	String found in binary or memory: https://marketingplatform.google.com/about/enterprise/
Source: chromecache_370.2.dr	String found in binary or memory: https://marketingplatform.google.com/about/enterprise/#webpage
Source: chromecache_370.2.dr	String found in binary or memory: https://marketingplatform.google.com/home?openIntegrationCenter=true&utm_source=marketingplatfor
Source: chromecache_582.2.dr	String found in binary or memory: https://measurement-api.criteo.com
Source: chromecache_625.2.dr	String found in binary or memory: https://mths.be/cssescape
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://news.booking.com/en-us/
Source: chromecache_513.2.dr	String found in binary or memory: https://oauth2.googleapis.com/revoke
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: chromecache_603.2.dr, chromecache_515.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/bg/%
Source: chromecache_424.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_ev=2&tx_gty=1&tx_id=ybyl
Source: chromecache_424.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_ev=2&tx_gty=4&tx_id=ybyl
Source: chromecache_649.2.dr, chromecache_424.2.dr, chromecache_458.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=$
Source: chromecache_556.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&bin=7&v=
Source: chromecache_556.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&name=invalid_geo&context=10
Source: chromecache_556.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=extra&rnd=
Source: chromecache_515.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224
Source: chromecache_603.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225
Source: chromecache_443.2.dr, chromecache_338.2.dr, chromecache_471.2.dr, chromecache_348.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_283.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/ping
Source: chromecache_553.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?
Source: chromecache_515.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224
Source: chromecache_603.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://partner.booking.com/en-gb?utm_campaign=footer_list&utm_medium=frontend_footer&utm_so
Source: chromecache_450.2.dr	String found in binary or memory: https://partner.booking.com/en-us/node/2217?utm_source=joinapp&medium=landing_page
Source: chromecache_450.2.dr	String found in binary or memory: https://partner.booking.com/en-us/node/2369?utm_source=joinapp&medium=landing_page
Source: chromecache_450.2.dr	String found in binary or memory: https://partner.booking.com/en-us/node/83636?utm_source=joinapp&medium=landing_page
Source: chromecache_450.2.dr	String found in binary or memory: https://partner.booking.com/en-us/node/88028?utm_source=joinapp&medium=landing_page
Source: chromecache_683.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://plus.google.com/105443419075154950489
Source: chromecache_450.2.dr	String found in binary or memory: https://q-xx.bstatic.com/cdata/joinapp/property_full_control.png
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://q-xx.bstatic.com/psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png
Source: chromecache_626.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3d
Source: chromecache_450.2.dr	String found in binary or memory: https://r-xx.bstatic.com/cdata/joinapp/meet_patricia.jpg
Source: chromecache_450.2.dr	String found in binary or memory: https://r-xx.bstatic.com/libs/perimeterx/px.v7.5.3.min.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://r-xx.bstatic.com/xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://r-xx.bstatic.com/xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc8
Source: chromecache_342.2.dr	String found in binary or memory: https://r-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3d
Source: chromecache_645.2.dr	String found in binary or memory: https://r.bstatic.com/libs/bui/7.3.1/bui.min.css
Source: chromecache_645.2.dr	String found in binary or memory: https://r.bstatic.com/libs/calango/0.500/bui.css
Source: chromecache_575.2.dr	String found in binary or memory: https://raw.githubusercontent.com/lokesh/color-thief/master/LICENSE
Source: chromecache_683.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_338.2.dr	String found in binary or memory: https://s.pinimg.com/ct/core.js
Source: chromecache_712.2.dr	String found in binary or memory: https://s.pinimg.com/ct/lib/main.43c0095c.js
Source: chromecache_322.2.dr	String found in binary or memory: https://s.pinimg.com/ct/lib/main.c6ca189a.js
Source: chromecache_338.2.dr	String found in binary or memory: https://s.yimg.jp/images/listing/tool/cv/ytag.js
Source: chromecache_322.2.dr, chromecache_338.2.dr, chromecache_581.2.dr	String found in binary or memory: https://sc-static.net/scevent.min.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/company/reservations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIw
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/company/reservations.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuA
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/company/search.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBm
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/company/search.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/content/complaints.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCi
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/content/complaints.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEX
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/content/cs.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/content/cs.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/help.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/help.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAE
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/help.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/login.html?op=oauth_return
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/myreservations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBm
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/myreservations.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/mysettings.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/mysettings.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr	String found in binary or memory: https://secure.booking.com/reviewtimeline.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBm
Source: chromecache_342.2.dr	String found in binary or memory: https://secure.booking.com/reviewtimeline.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_283.2.dr, chromecache_467.2.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/pagead/js/car.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://shelves.booking.com/
Source: chromecache_370.2.dr	String found in binary or memory: https://signup.withgoogle.com/newsletter/marketingplatform/
Source: chromecache_370.2.dr	String found in binary or memory: https://skillshop.withgoogle.com/
Source: chromecache_443.2.dr, chromecache_348.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_443.2.dr, chromecache_348.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_652.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_370.2.dr	String found in binary or memory: https://support.google.com/marketingplatform
Source: chromecache_683.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://sustainability.booking.com/
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BasicSetupEm
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BoardChartUp
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/ChannelManag
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/CustomerSupp
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Document
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Document.png
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Websites
Source: chromecache_450.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Websites.png
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png
Source: chromecache_652.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_458.2.dr, chromecache_348.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_603.2.dr	String found in binary or memory: https://tpc.googlesyndication.com
Source: chromecache_603.2.dr	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Source: chromecache_370.2.dr	String found in binary or memory: https://twitter.com/GMktgPlatform
Source: chromecache_370.2.dr	String found in binary or memory: https://twitter.com/Google
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://twitter.com/bookingcom
Source: chromecache_370.2.dr	String found in binary or memory: https://workspace.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mar
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.blog.google/products/marketingplatform/
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/?prefer_site_type=mdot
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/_frdtcr?aid=304142
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/accommodations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAEx
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/accommodations.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/affiliate-program/v2/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdI
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/affiliate-program/v2/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/airport.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/airport.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/apartments/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/apartments/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles.html
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/articles/bangkok-rooftop-bars.xu.html?aid=304142&amp;label=gen173nr-1FCA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles/bangkok-rooftop-bars.xu.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCi
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/articles/best-hotels-los-angeles.xu.html?aid=304142&amp;label=gen173nr-1
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles/best-hotels-los-angeles.xu.html?label=gen173nr-1FCAEoggI46AdIM1gEaI
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/articles/best-orlando-hotels-families.xu.html?aid=304142&amp;label=gen17
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles/best-orlando-hotels-families.xu.html?label=gen173nr-1FCAEoggI46AdIM
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/articles/best-ski-towns.xu.html?aid=304142&amp;label=gen173nr-1FCAEoggI4
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles/best-ski-towns.xu.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/articles/usa-thanksgiving-holiday-homes.xu.html?aid=304142&amp;label=gen
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/articles/usa-thanksgiving-holiday-homes.xu.html?label=gen173nr-1FCAEoggI46Ad
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/bed-and-breakfast/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIw
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/bed-and-breakfast/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEB
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/business.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/business.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/cars/sitemap.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/cars/sitemap.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/city.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2A
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/city.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECi
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content-moderation-policy/overview-page.html?aid=304142&label=gen173nr-1FCAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content-moderation-policy/overview-page.html?label=gen173nr-1FCAEoggI46AdIM1
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content/about.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content/about.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content/contact-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEB
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content/contact-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content/how_we_work.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content/how_we_work.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content/privacy.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content/privacy.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2A
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/content/terms.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/content/terms.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/country.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/country.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/covid-19-booking-faqs.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/covid-19-booking-faqs.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEX
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/deals/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/deals/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/dealspage.html?campaign_id=early_year
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/destination.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/destination.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/destinationfinderdeals.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwC
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/destinationfinderdeals.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/district.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/district.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdI
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXy
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/flights/index.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIw
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/flights/index.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/flights/sitemap.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/flights/sitemap.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2A
Source: chromecache_644.2.dr, chromecache_430.2.dr, chromecache_341.2.dr, chromecache_682.2.dr, chromecache_419.2.dr, chromecache_655.2.dr	String found in binary or memory: https://www.booking.com/general.html?tmpl=docs/privacy-policy
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/genius.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/genius.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/guest-house/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBm
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/guest-house/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/hostels/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/hostels/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/hotel/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/hotel/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ar.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.bg.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ca.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.cs.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.da.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.de.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.el.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.en-gb.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.es-ar.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.es-mx.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.es.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.et.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.fi.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.fr.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.he.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.hi.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.hr.html
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXy
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AEC
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.hu.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.id.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.is.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.it.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ja.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ko.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.lt.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.lv.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ms.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.nl.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.no.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.pl.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.pt-br.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.pt-pt.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ro.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.ru.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.sk.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.sl.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.sr.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.sv.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.th.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.tl.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.tr.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.uk.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.vi.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.zh-cn.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/index.zh-tw.html
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/landmark.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/landmark.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/region.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/region.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/resorts/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/resorts/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/reviews
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/searchresults.html
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/searchresults.html?aid=800210&si=ai
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/traveller-awards/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwC
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/traveller-awards/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAE
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/trust-and-safety.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/trust-and-safety.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2
Source: chromecache_626.2.dr	String found in binary or memory: https://www.booking.com/villas/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuA
Source: chromecache_342.2.dr	String found in binary or memory: https://www.booking.com/villas/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.bookingholdings.com/
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.bookingholdings.com/about/compliance-and-ethics/
Source: chromecache_631.2.dr, chromecache_322.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_652.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_652.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_652.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_603.2.dr, chromecache_370.2.dr, chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_370.2.dr, chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.google.com/#organization
Source: chromecache_652.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_370.2.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png
Source: chromecache_370.2.dr	String found in binary or memory: https://www.google.com/intl/en/policies/privacy/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.google.com/intl/en/policies/terms/
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_586.2.dr, chromecache_317.2.dr, chromecache_647.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1060768846/?random
Source: chromecache_354.2.dr, chromecache_335.2.dr, chromecache_546.2.dr, chromecache_429.2.dr, chromecache_519.2.dr, chromecache_643.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/973712236/?random
Source: chromecache_510.2.dr, chromecache_401.2.dr, chromecache_464.2.dr, chromecache_361.2.dr, chromecache_512.2.dr, chromecache_706.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/975716499/?random
Source: chromecache_665.2.dr, chromecache_425.2.dr, chromecache_549.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/988382855/?random
Source: chromecache_309.2.dr, chromecache_686.2.dr, chromecache_660.2.dr, chromecache_683.2.dr, chromecache_585.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_603.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/aframe
Source: chromecache_370.2.dr	String found in binary or memory: https://www.google.com/services/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://www.googleadservices.com/
Source: chromecache_556.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/managed/js/activeview/
Source: chromecache_443.2.dr, chromecache_338.2.dr, chromecache_471.2.dr, chromecache_348.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: chromecache_338.2.dr, chromecache_471.2.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_652.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_631.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js
Source: chromecache_370.2.dr, chromecache_450.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-5Q664QZ
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5Q664QZ
Source: chromecache_370.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-MPHTW35
Source: chromecache_450.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-MRN9HVQ
Source: chromecache_660.2.dr, chromecache_683.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__.
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googleg/2x/googleg_standard_color_192dp.png
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_alldp.ico
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_standard_16dp.ico
Source: chromecache_370.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_standard_32dp.ico
Source: chromecache_366.2.dr, chromecache_309.2.dr, chromecache_686.2.dr, chromecache_585.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.instagram.com/bookingcom/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.instagram.com/google/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.linkedin.com/showcase/googlemarketingplatform
Source: chromecache_443.2.dr, chromecache_348.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog/mc/collect
Source: chromecache_505.2.dr	String found in binary or memory: https://www.pinterest.com
Source: chromecache_370.2.dr	String found in binary or memory: https://www.thinkwithgoogle.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=
Source: chromecache_626.2.dr, chromecache_342.2.dr	String found in binary or memory: https://www.tiktok.com/
Source: chromecache_370.2.dr	String found in binary or memory: https://www.yourprimer.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marke
Source: chromecache_370.2.dr	String found in binary or memory: https://www.youtube.com/c/googlemarketingplatform
Source: chromecache_450.2.dr	String found in binary or memory: https://xx.bstatic.com/static/img/booking_logo_knowledge_graph.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 50689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443

Source: unknown	HTTPS traffic detected: 23.221.45.212:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.45.212:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_2460_564473003

Jump to behavior

Source: classification engine

Classification label: mal48.win@44/437@346/100

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,16912180351865998233,6883049137768924135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.com-find-book.com/p/6797383828
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,16912180351865998233,6883049137768924135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://booking.com-find-book.com/p/6797383828	100%	Avira URL Cloud	phishing
https://booking.com-find-book.com/p/6797383828	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=9b666d408486c66e6c24119f4b831f08&tag_format=img&tag_action=sync&cb=741315919	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/lokesh/color-thief/master/LICENSE	0%	Avira URL Cloud	safe
https://ws.rqtrk.eu/pushpull?pid=e873dca0-85f0-4b95-bfab-a8d855ece660&g=1&tr=1&return-unstable=true&uid=3a3d7220-b3fc-11ee-b421-e19f05c33ebf&cb=1705360643056&rmn=y&redirect=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2041%26partner_id%3D2130%26uid%3D%24BROWSER_ID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync%26rmt%3Dtrue%26cb%3D1705360643056	0%	Avira URL Cloud	safe
https://about.google/commitments/racialequity/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
booking.com-find-book.com	104.21.35.148	true	false	unknown
rtb-csync-use1.smartadserver.com	23.105.12.121	true	false	high
collector-pxikkul2rm.px-cloud.net	35.190.10.96	true	false	unknown
us-east-eb2.3lift.com	35.71.139.29	true	false	high
jelly.mdhv.io	216.239.34.21	true	false	unknown
ws.rqtrk.eu	51.222.241.145	true	false	unknown
d2pgys3db91n8r.cloudfront.net	18.173.219.37	true	false	high
d20qwf0wrdtevy.cloudfront.net	13.249.39.110	true	false	high
stats.g.doubleclick.net	142.251.111.154	true	false	high
cdn.w55c.net	54.209.243.229	true	false	high
dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	34.195.167.11	true	false	high
r.casalemedia.com	104.18.36.155	true	false	high
na-ice.360yield.com	44.215.44.145	true	false	high
visitor-us-west-2.omnitagjs.com	52.40.188.60	true	false	high
sync.crwdcntrl.net	3.226.158.19	true	false	high
fledge.va1.vip.prod.criteo.com	74.119.119.74	true	false	high
cm.g.doubleclick.net	172.253.115.156	true	false	high
pug-vac.pubmnet.com	8.28.7.83	true	false	unknown
idaas-ext.cph.liveintent.com	3.90.211.105	true	false	high
ds-pr-bh.ybp.gysm.yahoodns.net	34.206.227.189	true	false	unknown
www.google.com	172.253.122.106	true	false	high
rtb-csync-use2.smartadserver.com	147.135.94.221	true	false	high
idaas6.cph.liveintent.com	3.233.89.241	true	false	high
match.adsrvr.org	35.71.131.137	true	false	high
match.prod.bidr.io	52.86.139.62	true	false	unknown
google.com	172.253.115.102	true	false	high
pagead-googlehosted.l.google.com	142.250.31.132	true	false	high
chidc2.outbrain.org	50.31.142.223	true	false	unknown
widget.va1.vip.prod.criteo.com	74.119.119.150	true	false	high
dynamic.va1.vip.prod.criteo.com	74.119.119.142	true	false	high
securepubads46.g.doubleclick.net	172.253.115.155	true	false	high
sc-static.net	3.162.129.245	true	false	unknown
d32jgtbwout526.cloudfront.net	13.32.151.4	true	false	high
d1of1hbywxxm65.cloudfront.net	13.249.39.92	true	false	high
trends.revcontent.com	3.227.14.209	true	false	high
de2trjlt8e8rj.cloudfront.net	3.162.103.80	true	false	high
prod.pinterest.global.map.fastly.net	151.101.64.84	true	false	unknown
googleads.g.doubleclick.net	172.253.62.154	true	false	high
dualstack.pinterest.map.fastly.net	146.75.28.84	true	false	unknown
td.doubleclick.net	172.253.115.155	true	false	high
gum.va1.vip.prod.criteo.com	74.119.119.139	true	false	high
clients.l.google.com	142.251.163.101	true	false	high
match-us-east-1-ecs.sharethrough.com	52.6.62.160	true	false	high
cdn.cookielaw.org	104.18.131.236	true	false	high
user-data-us-east.bidswitch.net	35.211.178.172	true	false	unknown
d2i5gg36g14bzn.cloudfront.net	52.85.132.125	true	false	high
dart.l.doubleclick.net	142.251.16.149	true	false	high
hb.yahoo.net	23.58.127.113	true	false	high
www.googletagservices.com	142.251.111.155	true	false	high
d2uxzmvxe6bz7q.cloudfront.net	108.138.85.78	true	false	high
www3.doubleclick.net	142.251.167.100	true	false	high
us-vip001.taboola.com	141.226.224.48	true	false	high
adservice.google.com	172.253.63.154	true	false	high
d8c14d4960ca.edge.sdk.awswaf.com	18.165.98.45	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
gtm-mktg.booking.com	216.239.36.21	true	false	high
contextual.media.net	23.209.60.28	true	false	high
d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	52.85.132.115	true	false	unknown
gcp.api.sc-gw.com	35.190.43.134	true	false	unknown
marketingplatform.google.com	172.253.63.138	true	false	high
windowsupdatebg.s.llnwi.net	69.164.0.128	true	false	unknown
pixel.tapad.com	34.111.113.62	true	false	high
sync.ipredictive.com	54.157.70.26	true	false	unknown
accounts.google.com	142.251.16.84	true	false	high
pcs3prod18.us-east-1.elasticbeanstalk.com	3.224.246.109	true	false	high
du1b3vb35hc0o.cloudfront.net	13.32.208.58	true	false	high
ad.doubleclick.net	142.251.163.149	true	false	high
static.va1.vip.prod.criteo.net	74.119.119.131	true	false	high
exchange.mediavine.com	54.224.27.48	true	false	high
d2jothlt68ryaj.cloudfront.net	18.164.96.33	true	false	high
s.ad.smaato.net	18.67.76.69	true	false	high
analytics.google.com	172.253.63.113	true	false	high
ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud	34.200.65.202	true	false	unknown
usc1-gcp-v61.api.sc-gw.com	35.190.43.134	true	false	unknown
measurement-api.va1.vip.prod.criteo.com	74.119.119.71	true	false	high
ib.anycast.adnxs.com	68.67.160.76	true	false	high
visitor-usa02.omnitagjs.com	195.244.31.10	true	false	high
geolocation.onetrust.com	104.18.32.137	true	false	high
booking.com	13.249.39.5	true	false	high
securepubads.g.doubleclick.net	unknown	unknown	false	high
web-vitals.booking.com	unknown	unknown	false	high
pm.w55c.net	unknown	unknown	false	high
tr.snapchat.com	unknown	unknown	false	high
secure.adnxs.com	unknown	unknown	false	high
r-xx.bstatic.com	unknown	unknown	false	high
ads.stickyadstv.com	unknown	unknown	false	unknown
z.moatads.com	unknown	unknown	false	unknown
dynamic.criteo.com	unknown	unknown	false	high
jadserve.postrelease.com	unknown	unknown	false	high
sslwidget.criteo.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
accommodations.booking.com	unknown	unknown	false	high
cf.bstatic.com	unknown	unknown	false	high
dis.criteo.com	unknown	unknown	false	high
static.criteo.net	unknown	unknown	false	high
i6.liadm.com	unknown	unknown	false	high
measurement-api.criteo.com	unknown	unknown	false	high
t-cf.bstatic.com	unknown	unknown	false	high
nellie.booking.com	unknown	unknown	false	high
pixel.rubiconproject.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cf.bstatic.com/psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js	false		high
https://www.booking.com/js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3006&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls	false		high
https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js	false		high
https://ct.pinterest.com/v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360599275&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D	false		high
https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css	false		high
about:blank	false	Avira URL Cloud: safe	low
https://www.google.com/pagead/1p-user-list/975716499/?random=1705360598042&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_C6dkLDIEgTr3RTf_2TVnFzs80O94zc7a39hyjaqYJl-D_6MN&random=1991363687&rmt_tld=0&ipr=y	false		high
https://www.google.com/pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100	false		high
https://sync.crwdcntrl.net/map/ct=y/c=14717/tp=MWSP/tpid=3a3d7220-b3fc-11ee-b421-e19f05c33ebf?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile_id%7D%26tag_format%3Dimg%26tag_action%3Dsync%26cb%3D%24%7Brandom%7D	false		high
https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css	false		high
https://cf.bstatic.com/psb/capla/static/js/4ff72d09.d3848f83.chunk.js	false		high
https://www.booking.com/js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6	false		high
https://tr.snapchat.com/cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f	false		high
https://cf.bstatic.com/static/img/favicon.ico	false		high
https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360575042	false		high
https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json	false		high
https://cf.bstatic.com/psb/capla/static/js/a6a21c13.3e4975b8.chunk.js	false		high
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-v3dMh0wC227b84Dh6MIXwLUNPlL4tr_xfs2WKw&initiator=partner	false		high
https://cf.bstatic.com/psb/capla/static/media/world-map.7d457a5d.png	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni	false		high
https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360594846	false		high
https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css	false		high
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-9S_M1EwC227b84Dh6MIXwLUNPlJJYMCuDuORSQ	false		high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high
https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css	false		high
https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png	false		high
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-j_u43kwC227b84Dh6MIXwLUNPlIXqteyIcmcYg&dongle=013b&gdpr=0&cmp_cs=&us_privacy=	false		high
https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?	false		high
https://www.google.com/pagead/1p-user-list/1060768846/?random=1705360597923&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_fupSUXTRqaTLl3HIjS40PJucnnu-JQRD_0-RDLxHwytskKyq&random=508482912&rmt_tld=0&ipr=y	false		high
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-uDqynEwC227b84Dh6MIXwLUNPlJSWgYJ0xCs_w	false		high
https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css	false		high
https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js	false		high
https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-uovk5UwC227b84Dh6MIXwLUNPlKwORV10IAgVA&verify=true	false		high
https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360602797	false		high
https://partner.mediawallahscript.com/?account_id=2023&partner_id=2118&uid=9b666d408486c66e6c24119f4b831f08&tag_format=img&tag_action=sync&cb=741315919	false	Avira URL Cloud: safe	unknown
https://cf.bstatic.com/psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js	false		high
https://cf.bstatic.com/psb/capla/static/css/3d066b0d.e1874fca.chunk.css	false		high
https://cf.bstatic.com/static/js/main_cloudfront_sd/d28523665f62421e5c65b8c6fc6848b561f4e4a2.js	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://11963210.fls.doubleclick.net/activityi;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=460620828.1705360583;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar?	false		high
https://s.pinimg.com/ct/lib/main.43c0095c.js	false		high
https://cf.bstatic.com/psb/capla/static/js/445be7a9.21674fdf.chunk.js	false		high
https://ws.rqtrk.eu/pushpull?pid=e873dca0-85f0-4b95-bfab-a8d855ece660&g=1&tr=1&return-unstable=true&uid=3a3d7220-b3fc-11ee-b421-e19f05c33ebf&cb=1705360643056&rmn=y&redirect=https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2041%26partner_id%3D2130%26uid%3D%24BROWSER_ID%26custom%3D%26tag_format%3Dimg%26tag_action%3Dsync%26rmt%3Dtrue%26cb%3D1705360643056	false	Avira URL Cloud: safe	unknown
https://cf.bstatic.com/psb/capla/static/js/b9a82cb8.4f94b8d4.chunk.js	false		high
https://gum.criteo.com/syncframe?topUrl=join.booking.com&origin=onetag#{%22bundle%22:{%22origin%22:0,%22value%22:null},%22cw%22:true,%22optout%22:{%22origin%22:0,%22value%22:null},%22origin%22:%22onetag%22,%22sid%22:{%22origin%22:0,%22value%22:null},%22tld%22:%22booking.com%22,%22topUrl%22:%22join.booking.com%22,%22version%22:%225_20_0%22,%22ifa%22:{%22origin%22:0,%22value%22:null},%22lsw%22:true,%22pm%22:0}	false		high
https://cf.bstatic.com/static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js	false		high
https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=1523317164.1705360584&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://istatic.booking.com/internal-static/capla/static/js/cfbdd235.aa2e272b.chunk.js.map	chromecache_428.2.dr	false		high
https://join.booking.com/index.html?aid=304142	chromecache_450.2.dr	false		high
https://www.booking.com/index.fi.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_652.2.dr	false		high
https://cf.bstatic.com/static/css/ski_lp_overview_panel_cloudfront_sd.iq_ltr/2b3350935410fe4e36d74ef	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://www.booking.com/index.lv.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://secure.booking.com/reviewtimeline.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM	chromecache_342.2.dr	false		high
https://www.booking.com/index.is.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_660.2.dr, chromecache_683.2.dr	false		high
https://cf.bstatic.com/static/js/pega_cloudfront_sd/632057f4cc4f9dcc5b9cb8662e00c014a2c732e1.js	chromecache_322.2.dr	false		high
https://lh3.googleusercontent.com/eBgXEvVz_cqaqw5ZZRjWndAKwLuWlFXuf9CW0NHHMgK3BY5TCrI2AE1tsq20ZeXM55	chromecache_370.2.dr	false		high
https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845e	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://lh3.googleusercontent.com/wrHKPwn_RKCusdpmICnKeZoYVzfup5x3e6UFj58iVzEymAnru1XWjhrl2mFu5eLJ8X	chromecache_370.2.dr	false		high
https://lh3.googleusercontent.com/McJV-U6w665Cr7SFm8uBmRog_9DPfbCdntR4aK0tL2wjaXrKc0EsUT649iJOlZfVAA	chromecache_370.2.dr	false		high
https://cloud.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marketi	chromecache_370.2.dr	false		high
https://www.booking.com/content-moderation-policy/overview-page.html?label=gen173nr-1FCAEoggI46AdIM1	chromecache_342.2.dr	false		high
https://secure.booking.com/mysettings.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu	chromecache_626.2.dr	false		high
https://www.booking.com/business.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-	chromecache_342.2.dr	false		high
https://firebase.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark	chromecache_370.2.dr	false		high
https://www.booking.com/index.sk.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://account.booking.com/sso/logout/v3	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB	chromecache_342.2.dr	false	Avira URL Cloud: safe	low
https://cf.bstatic.com/psb/capla/	chromecache_450.2.dr	false		high
https://www.booking.com/articles/best-ski-towns.xu.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAE	chromecache_342.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/css/1baf5a63.539e3a8f.chunk.css.map	chromecache_633.2.dr	false		high
https://www.booking.com/index.nl.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://googleads.g.doubleclick.net/	chromecache_338.2.dr, chromecache_471.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/css/7a53cdfb.d6ed6882.chunk.css.map	chromecache_547.2.dr	false		high
https://github.com/google/safevalues/issues	chromecache_467.2.dr	false		high
https://cloud.google.com/contact	chromecache_660.2.dr, chromecache_683.2.dr	false		high
https://www.booking.com/index.hu.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://www.booking.com/region.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM	chromecache_626.2.dr	false		high
https://www.booking.com/index.de.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://cf.bstatic.com/static/js/async_lists_cloudfront_sd/ea653b9852a85cb0190755d3979dbd317a486979.	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a1d6f1ae66ba2355300f85f32baadee	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://www.booking.com/index.en-gb.html	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://www.booking.com/articles/bangkok-rooftop-bars.xu.html?aid=304142&amp;label=gen173nr-1FCA	chromecache_626.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/css/4ff72d09.17169d33.chunk.css.map	chromecache_315.2.dr	false		high
https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2	chromecache_626.2.dr	false		high
https://secure.booking.com/content/complaints.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCi	chromecache_626.2.dr	false		high
https://partner.booking.com/en-us/node/88028?utm_source=joinapp&medium=landing_page	chromecache_450.2.dr	false		high
https://admin.booking.com/hotel/hoteladmin/?lang=xu	chromecache_450.2.dr	false		high
https://analytics.google.com/analytics/academy/?utm_source=marketingplatform.google.com&utm_medium=e	chromecache_370.2.dr	false		high
https://raw.githubusercontent.com/lokesh/color-thief/master/LICENSE	chromecache_575.2.dr	false	Avira URL Cloud: safe	unknown
https://cf.bstatic.com/static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3d	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge	chromecache_626.2.dr, chromecache_342.2.dr	false		high
https://about.google/commitments/racialequity/	chromecache_370.2.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_660.2.dr, chromecache_683.2.dr	false		high
https://www.booking.com/content/terms.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExu	chromecache_626.2.dr	false		high
https://www.booking.com/cars/sitemap.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6	chromecache_342.2.dr	false		high
https://www.booking.com/content/how_we_work.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyA	chromecache_342.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.62.154	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
74.119.119.139	gum.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
13.249.39.128	unknown	United States	16509	AMAZON-02US	false
13.249.39.5	booking.com	United States	16509	AMAZON-02US	false
142.251.163.101	clients.l.google.com	United States	15169	GOOGLEUS	false
74.119.119.131	static.va1.vip.prod.criteo.net	United States	19750	AS-CRITEOUS	false
146.75.28.84	dualstack.pinterest.map.fastly.net	Sweden	30051	SCCGOVUS	false
172.253.122.84	unknown	United States	15169	GOOGLEUS	false
172.253.63.113	analytics.google.com	United States	15169	GOOGLEUS	false
151.101.128.84	unknown	United States	54113	FASTLYUS	false
3.162.103.47	unknown	United States	16509	AMAZON-02US	false
18.67.76.69	s.ad.smaato.net	United States	3	MIT-GATEWAYSUS	false
172.253.115.102	google.com	United States	15169	GOOGLEUS	false
216.239.36.21	gtm-mktg.booking.com	United States	15169	GOOGLEUS	false
52.85.132.125	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
172.253.62.148	unknown	United States	15169	GOOGLEUS	false
35.71.131.137	match.adsrvr.org	United States	237	MERIT-AS-14US	false
13.249.39.37	unknown	United States	16509	AMAZON-02US	false
195.244.31.10	visitor-usa02.omnitagjs.com	France	63140	IGUANA-WORLDWIDEUS	false
35.171.143.90	unknown	United States	14618	AMAZON-AESUS	false
54.224.27.48	exchange.mediavine.com	United States	14618	AMAZON-AESUS	false
74.119.119.142	dynamic.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
3.224.246.109	pcs3prod18.us-east-1.elasticbeanstalk.com	United States	14618	AMAZON-AESUS	false
142.251.16.149	dart.l.doubleclick.net	United States	15169	GOOGLEUS	false
68.67.160.76	ib.anycast.adnxs.com	United States	29990	ASN-APPNEXUS	false
3.234.138.61	unknown	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.32.208.58	du1b3vb35hc0o.cloudfront.net	United States	16509	AMAZON-02US	false
172.253.115.113	unknown	United States	15169	GOOGLEUS	false
3.231.143.26	unknown	United States	14618	AMAZON-AESUS	false
68.67.179.87	unknown	United States	29990	ASN-APPNEXUS	false
13.249.39.47	unknown	United States	16509	AMAZON-02US	false
23.209.60.28	contextual.media.net	United States	16625	AKAMAI-ASUS	false
18.173.219.37	d2pgys3db91n8r.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
142.251.167.100	www3.doubleclick.net	United States	15169	GOOGLEUS	false
172.253.63.138	marketingplatform.google.com	United States	15169	GOOGLEUS	false
34.206.227.189	ds-pr-bh.ybp.gysm.yahoodns.net	United States	14618	AMAZON-AESUS	false
74.119.119.150	widget.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
34.235.32.60	unknown	United States	14618	AMAZON-AESUS	false
108.138.85.49	unknown	United States	16509	AMAZON-02US	false
104.21.35.148	booking.com-find-book.com	United States	13335	CLOUDFLARENETUS	false
104.18.131.236	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
142.251.16.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.163.99	unknown	United States	15169	GOOGLEUS	false
34.200.65.202	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud	United States	14618	AMAZON-AESUS	false
52.85.132.12	unknown	United States	16509	AMAZON-02US	false
3.227.14.209	trends.revcontent.com	United States	14618	AMAZON-AESUS	false
147.135.94.221	rtb-csync-use2.smartadserver.com	United States	16276	OVHFR	false
23.222.200.28	unknown	United States	16625	AKAMAI-ASUS	false
23.58.127.72	unknown	United States	577	BACOMCA	false
35.190.43.134	gcp.api.sc-gw.com	United States	15169	GOOGLEUS	false
172.253.63.132	unknown	United States	15169	GOOGLEUS	false
3.162.103.80	de2trjlt8e8rj.cloudfront.net	United States	16509	AMAZON-02US	false
68.67.160.24	unknown	United States	29990	ASN-APPNEXUS	false
142.251.163.147	unknown	United States	15169	GOOGLEUS	false
142.251.163.149	ad.doubleclick.net	United States	15169	GOOGLEUS	false
74.119.119.74	fledge.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
172.253.115.149	unknown	United States	15169	GOOGLEUS	false
35.211.178.172	user-data-us-east.bidswitch.net	United States	19527	GOOGLE-2US	false
172.253.115.148	unknown	United States	15169	GOOGLEUS	false
8.28.7.83	pug-vac.pubmnet.com	United States	62713	AS-PUBMATICUS	false
52.86.139.62	match.prod.bidr.io	United States	14618	AMAZON-AESUS	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
172.253.115.147	unknown	United States	15169	GOOGLEUS	false
52.40.188.60	visitor-us-west-2.omnitagjs.com	United States	16509	AMAZON-02US	false
18.164.96.33	d2jothlt68ryaj.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
99.84.191.14	unknown	United States	16509	AMAZON-02US	false
108.138.85.68	unknown	United States	16509	AMAZON-02US	false
74.119.119.71	measurement-api.va1.vip.prod.criteo.com	United States	19750	AS-CRITEOUS	false
172.253.122.106	www.google.com	United States	15169	GOOGLEUS	false
172.253.122.105	unknown	United States	15169	GOOGLEUS	false
142.250.31.132	pagead-googlehosted.l.google.com	United States	15169	GOOGLEUS	false
52.85.132.30	unknown	United States	16509	AMAZON-02US	false
104.18.36.155	r.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
44.215.44.145	na-ice.360yield.com	United States	14618	AMAZON-AESUS	false
142.251.167.84	unknown	United States	15169	GOOGLEUS	false
52.6.62.160	match-us-east-1-ecs.sharethrough.com	United States	14618	AMAZON-AESUS	false
3.162.129.245	sc-static.net	United States	16509	AMAZON-02US	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
108.138.85.78	d2uxzmvxe6bz7q.cloudfront.net	United States	16509	AMAZON-02US	false
54.172.56.55	unknown	United States	14618	AMAZON-AESUS	false
172.253.115.84	unknown	United States	15169	GOOGLEUS	false
3.233.89.241	idaas6.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
13.32.151.4	d32jgtbwout526.cloudfront.net	United States	16509	AMAZON-02US	false
35.190.10.96	collector-pxikkul2rm.px-cloud.net	United States	15169	GOOGLEUS	false
151.101.64.84	prod.pinterest.global.map.fastly.net	United States	54113	FASTLYUS	false
172.64.151.101	unknown	United States	13335	CLOUDFLARENETUS	false
34.195.167.11	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
50.31.142.223	chidc2.outbrain.org	United States	22075	AS-OUTBRAINUS	false
23.105.12.121	rtb-csync-use1.smartadserver.com	United States	30633	LEASEWEB-USA-WDCUS	false
172.253.122.156	unknown	United States	15169	GOOGLEUS	false
52.85.132.107	unknown	United States	16509	AMAZON-02US	false
18.165.98.45	d8c14d4960ca.edge.sdk.awswaf.com	United States	3	MIT-GATEWAYSUS	false
216.239.34.21	jelly.mdhv.io	United States	15169	GOOGLEUS	false
13.249.39.92	d1of1hbywxxm65.cloudfront.net	United States	16509	AMAZON-02US	false
51.222.241.145	ws.rqtrk.eu	France	16276	OVHFR	false
3.162.103.9	unknown	United States	16509	AMAZON-02US	false
13.225.195.71	unknown	United States	16509	AMAZON-02US	false
142.251.167.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1375040
Start date and time:	2024-01-16 00:15:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://booking.com-find-book.com/p/6797383828
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@44/437@346/100
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.booking.com/#indexsearch Browse: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Browse: https://secure.booking.com/help.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&source=header&src=profile_contact_cs Browse: https://join.booking.com/?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b5d1abbbd&utm_medium=frontend&utm_source=topbar

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.179.94, 34.104.35.123, 172.253.122.139, 172.253.122.138, 172.253.122.102, 172.253.122.100, 172.253.122.101, 172.253.122.113, 172.253.122.95, 172.253.63.95, 142.251.16.95, 172.253.62.95, 142.251.163.95, 142.251.167.95, 172.253.115.95, 20.12.23.50, 104.97.85.53, 72.21.81.240, 192.229.211.108, 172.253.63.97, 172.253.115.156, 172.253.115.155, 172.253.122.94, 20.242.39.171, 204.79.197.200, 13.107.21.200, 142.250.31.156, 142.250.31.155, 142.251.16.156, 142.251.16.157, 172.253.122.132, 172.253.115.94, 142.251.16.132, 142.251.163.154, 142.251.163.155, 13.95.31.18, 172.253.63.155, 172.253.63.154, 142.251.167.156, 142.251.167.157, 142.251.167.154, 142.251.167.155, 23.221.45.145, 23.43.243.72, 23.43.243.112, 172.253.62.132, 142.251.111.94, 69.173.151.100, 23.220.189.76, 63.251.28.234, 63.251.28.133, 63.251.28.134, 63.251.28.233, 23.197.109.53, 34.193.251.250, 107.21.19.202, 34.202.246.49, 3.209.115.69, 18.213.141.199, 44.217.105.65
Excluded domains from analysis (whitelisted): fp4.ads.stickyadstv.com.akadns.net, tags.bluekai.com.edgekey.net, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, e9126.x.akamaiedge.net, ocsp.digicert.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, www.gstatic.com, rtb-csync-geo.usersync-prod-sas.akadns.net, www.google-analytics.com, e9957.e4.akamaiedge.net, fonts.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, dual-a-0001.a-msedge.net, 22b7de70070b66a71431259564d59756.safeframe.googlesyndication.com, pagead2.googlesyndication.com, 0bc83a5be386a6200edf12c709bbfe62.safeframe.googlesyndication.com, edgedl.me.gvt1.com, c.bing.com, g11v.fwgtm.akadns.net, www.googleadservices.com, pixel.rubiconproject.net.akadns.net, c-bing-com.a-0001.a-msedge.net, 38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com, wildcard.moatads.com.edgekey.net, wu.azureedge.net, www.googletagmanager.com, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs1
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: https://booking.com-find-book.com/p/6797383828

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 15 22:16:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9690189197194266
Encrypted:	false
SSDEEP:	48:8RdETognHiidAKZdA19ehwiZUklqehGy+3:8gf4dy
MD5:	C474CD1F37CF52ABE0969BC7462EFEEB
SHA1:	54BF6FE3DCA53F320782C54CF94D5A217AA29C02
SHA-256:	65468557D5D5548138F21B821A61F40EE33BDACA3AF08CD6F216DFF7B66F9090
SHA-512:	5560B380B62A9FE953F3362B431AF512AB6844F8394CCCD17FB4363DAF9E381A0793F20FE5B574B813B43257E1E2D9E65831BD6AC7833ACA897A3F945020790A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....M@...H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 15 22:16:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9857986374297454
Encrypted:	false
SSDEEP:	48:8pdETognHiidAKZdA1weh/iZUkAQkqehNy+2:8YfS9QQy
MD5:	061933915F13215B4C7488202ED9CA1F
SHA1:	D884388C4514FE19B17645E37DC5651626D85E7F
SHA-256:	9108AAB46C5CB22240914DF4DADF14D11C860174A56FD7A7DED0C77E13039725
SHA-512:	1069F4752B8500E0627AA47B4930053419C98ED6252EE80D59C372CB6FF982CC5C8F15066EE5EC0B6115437471899D339C2D267183EC19024C9FF54CA829F4D7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....'...H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.99598110712409
Encrypted:	false
SSDEEP:	48:8xxdETogsHiidAKZdA14tseh7sFiZUkmgqeh7sHy+BX:8xAfPnxy
MD5:	12BAE58DB8BE0B16144A27FEA2AB23D8
SHA1:	C3AC6E9C528FE9624A2B3042641D5722EE92419B
SHA-256:	5A34BE17B1EB9953541B1F629F2DCC736BE14E5A2E3E7F4DCFAD160A7134C042
SHA-512:	52472978A2B464C88E63B023E19385A0C6E0EE98C8C803160487E78E358A5274CA3308F43FBD44788759529F67353A515D2878C4AD93CB2B75D6602888081534
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 15 22:16:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983890964915545
Encrypted:	false
SSDEEP:	48:8bdETognHiidAKZdA1vehDiZUkwqehJy+R:8af5fy
MD5:	7B17DEC9EB2745753283DD2801D35159
SHA1:	6DC8023C6799673E84E024ABC021CA1FC3691DD9
SHA-256:	57F1FF44655A4CD66809665653FA6067D64B297E9B1665384386550B7691370A
SHA-512:	9AFEC66170DD341C5E79BD0127FE3BE19CB32E5D4A789B3B323DDAFF60C5C4DA8DF313CEB1124A543E3E4B719E1548B5C527200D19EC289F20D6D8FDF626FF15
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......w..H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 15 22:16:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.971569289063992
Encrypted:	false
SSDEEP:	48:8AdETognHiidAKZdA1hehBiZUk1W1qehLy+C:8rfJ9ry
MD5:	F139F85A190A664A4E757B0B4C66776B
SHA1:	C434DB23507586E24B3F02119610298446F4ABC3
SHA-256:	9B82ADC5858FFEBA6712623E27858C1DB9A9102F0121A0A4DFB1A37B13613B07
SHA-512:	CD05A9D4C57757112C728B8C71E527116E0553EB20D4683456DD2DCB18FDEF75728CDADFD23E2D8145B5FC04069282A77514C282D2EA99F9FC2AEC4B561C0798
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....:...H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 15 22:16:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9814434035818325
Encrypted:	false
SSDEEP:	48:8udETognHiidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbxy+yT+:8hfVT/TbxWOvTbxy7T
MD5:	73F4AB7D4F2AFB8D8F1D70420B50FA10
SHA1:	53EEF390CCD7CC387ACB4CE988DC996F73C8093D
SHA-256:	50FBB325025CAF93462CBD2B2D2686B6C7B55235E5CBFFB6BAFC54053CC6C827
SHA-512:	4E4B161E220B5DE26DF9EF7A8EA5FEB237984422C9255D744B77ED8A77F5E8057B217AA5C61D91AD5FC63750EAD34937C234AF551EB888FD08C322D51A8ACA88
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....d.m..H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	7.8875883951747925
Encrypted:	false
SSDEEP:	48:j/6u3CtuLhUGh0H5UFe2pYo37Esd2gjEj7seiEfE/ODAtLx:jSRuLKA0ZUFnR4sPEUeJf8/
MD5:	27E71A5124018E16EAE0B8897618623D
SHA1:	D0D54D88B04EDFC71F338C19EAB9994632BC6CED
SHA-256:	1D6E86E59AB7235A8343F494C8E8DA6CC02C5A98A75D682401340E6D06935F20
SHA-512:	A9D6F6B881175780E2619843AA88AACE7E94DA178C53C3DDDE691A930C5412FC4CD817009D488757835903D9218758F808AC36C1F828371D57AF91EA9CF3170A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...F..........b.....pHYs.................sRGB.........gAMA......a.....IDATx..Y.pT..>...........e....f.+(T.L..KiZ.....`..c;v .....u.M...h.........DJ..RQ..-?!FlB.}..~w./........3s..}..s.{...et.Kyy.....;v.....N..p.....I4=...t..'.BI.,/X..R.0.%.<.....F...i.6..rSJ.......Mgy0x.#.:....YYY....}.....~..L..M...........d.`..t...>Gi.K......)W.x.i?.5H.........Q...-0z..8 ?..IR.G`..N..`p...Q<.t.i2..~)K.G..l\y(4E..y.31.7.(....Wa..>......_RR....6.-..7...Iy..y;......~.<..T....)k.e...D.f...........2.k..0.=.[..D..n...W..V.B..uVUU..."5m.0W._.0a..^.'...V8x.. e.I...H8..... ..N;....".&.J...Hd.l).81....5.c...<.....W.o....U/(..,.O..+.c.ZZZ........L..c...V..[...... .g(.Y..P....>.>.-v?....>..&.?j.A....)5Q...KO....'.l..G...:.b{..#..4.`.[.]..V..20.k.-W.<.m[.q.BA.i........!...,.6.....N...l2.......`......1...o^...iY.]...&.O....\.c.>L.w...:.......u..d9.f.Ld.*....J...=...1....A.!&.c......f.}s....,."..e.....2....)...%..o..I\."_JL..id..c.N.y...k...p.m..A...

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (31595)
Category:	downloaded
Size (bytes):	103219
Entropy (8bit):	5.479253163675781
Encrypted:	false
SSDEEP:	1536:2NFNM3KxdVu8Z8OMIocFLH4XFrMplIeHiJp9WW4ITTMjFqOYc4U8oRHryE+:EqCJocJlfH2p9542MjFmcc6eB
MD5:	2C4171ECA0E1532375739418B89CCEF4
SHA1:	B9B010801FB0148BB96F0F3A245B05B90F392FF0
SHA-256:	D54BFC003390DAB9E8B16DC32DC5D1C5A6CC567C3ADC44251E541933DDB508E9
SHA-512:	E033C092636F6D4760BA4285D2222F30967698E90ED6B11D760F5808FF4CC59FF43A4766D261641B8842D1B3EE6184B0E8D89FD8FB47B5797FFCD4F22AEFE312
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8" />. <title>Topics Frame</title>. <meta. http-equiv="origin-trial". content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=". />. <script>. ./.. Copyright 2022 Google LLC. SPDX-License-Identifier: Apache-2.0./.var m,aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.442406461865354
Encrypted:	false
SSDEEP:	12:6v/7gCbGChpg7/6T6rE3U18KYmNeLg0jFKnoqmhDbxhLUGS+nSASUo1:4hS7/6eo3QYmNuFb9xBUX3ASf
MD5:	63B6187CE089A07D285D837208370F19
SHA1:	A4C2C0BE9A7D2C776BE39ACBDA154846329B42D2
SHA-256:	0D29D4300DBCCC76FE8438937B7F827DFF8EE65767F4CE7168172FE2083B63C3
SHA-512:	AD32C281A7FCF7A0814548578417B01994E31937DC3AC0C73D9CD848F37438C53215E5AEFBF9B44D4076499511D6D3D30BC5E1BD5FEB278B16C14C1BB42FFF21
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...G...x......B.U...iPLTELiq..U..T..T....!X..T...........T..................U........................5Ly..1$;l.....\ey..........F/.....tRNS...y....q2J..SmoS......pHYs.................IDATx...r.0.E#1T....4....?.CQ...C2B;9O.9..]y.B......@6...@...<.M.@l....pS...l. ...Xx..2....;..7..a.mc.....u9....h.il.A.".`...!.-..d..]_.cO.:.B..9..&...TG..R.....i..r1-E....<.Y...X..i<.{.S.yt...{j.. 6....\|....a..~L...z.S..)W=.....e...{..y.(>....(O=.\|Oy.)g{....{V........l.........0.Y<....9.k......<..$......./g....x....H_+....#.XA_&0....3...5.\U.......6)...u...E.l.x........<...Z..J.o...5....IEND.B`.

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	76128
Entropy (8bit):	5.062490993314619
Encrypted:	false
SSDEEP:	768:58pcPWW6C2sFRGMgxE6i31vpeA3PMRXnCOcU:58pcWW6C+AFBeA3M
MD5:	52EB5BCC636C1434AFA48251F23FD23F
SHA1:	40CE8F82E75382BDEC2C3099329F7509233D2187
SHA-256:	D9C61F5C3BEFDDB00D43E46A724E1ECCCD1ED1B6B81CECD22009F7CFDA277570
SHA-512:	31469C4786AFE9106AF6055557346C65FB7A32649153236442967EF0A96A99AA05FE8024F50451F7ABA64261F674EFB0D0348A8844D827B75498807134EAE047
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css
Preview:	.bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);box-shadow:0 1px 2px rgba(0,0,0,0.1);font-size:14px;position:relative;z-index:2}.ultra-focus-body .bbtool-notification--top-menu{z-index:auto}.bbtool-notification--outside-tool{background-color:#f5f5f5}body.bb-sr-mo-own .bbtool-notification--top-menu{background-color:#e6e6e6}.company .bbtool-notification--top-menu{background-color:var(--bui_color_white)}.bbtool-notification--index{margin-bottom:10px}.bbtool-notification,.bbtool-notification a:link,.bbtool-notification a:visited{font-weight:normal}.bbtool-notification--outside-tool a.bbtool-top-menu-link:hover,.a11y .bbtool-notification--outside-tool a.bbtool-top-menu-link:hover{color:#333;background-color:#e6e6e6}.bbtool-notification__wrapper{max-width:1110px;margin:0 auto}.bbtool-noti

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=826270f9-62fe-4a6d-be16-94d618ec54f0&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=2768&m_fcps=2531&m_pi=2714&m_pl=4615&m_pv=2&m_rd=6224&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=8cdddd56-5cf7-41c3-af77-7a029b3c4e56&ts=1705360598553&v=3.8.0-2401042024
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	528195
Entropy (8bit):	5.433499531580268
Encrypted:	false
SSDEEP:	6144:w8+Uf+Wp58gP7Myc0cWRyLxstcWRo8uW8R6BjCXUSxBBjClBLTySrHVJqPh8P/NW:5P78SDVJqPh8P/NImrMFHk2rR
MD5:	A49908DD31F3E4BD429D8384882C9CD8
SHA1:	7873CFE80835FF405E01EA5A0C238B07B258A934
SHA-256:	FBF0BC4DBB8C5F60085A420B399FEF5DA7994905BC62722B87451927C8DE375B
SHA-512:	FAC42DAC31E0CF9BA27F3A56B69B63D2C4BD6B2078347E5526A5983DFFAAF05834BE2F035FF0AD96B30F49A4A27950FAF96BAAB0A8E504D6B16FCA5C522475E8
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/8207c303.bdceabc2.chunk.js
Preview:	/! For license information please see 8207c303.bdceabc2.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["8207c303"],{d0989236:function(e,n,t){"use strict";t.d(n,{B:function(){return a}});var i=t("dc6d28ff");function a(){const e=(0,i.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInterna

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5677)
Category:	downloaded
Size (bytes):	5793
Entropy (8bit):	5.313932545638592
Encrypted:	false
SSDEEP:	96:HxCgLnRo0x23QB7gyCi9rOLkLCk0IkT7bnpBNnEp8gm40SE:HxBRvx23QB7gyCQHLJWT7bjNnkeqE
MD5:	1FE97FF079513BB667876C67C4AA952F
SHA1:	10EC4B195651DF551786371EB0C7BF5DC08AB31D
SHA-256:	45D9AD26CC62E6B943AC3796E9212498C96DE7AC3D67067E3D436F84A3D6DCC1
SHA-512:	50885AAC34B7C3765CE4F4DB4A8FFABDACA57DAE5D03289B84C9BBD0FEFD789464169D8536319CB01537F127D40FE7B064A8DD29E3AC8B410FB49445CE672FA9
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/3d066b0d.e1874fca.chunk.css
Preview:	.b82528c917{flex:1;display:flex;flex-direction:column;justify-content:center}.af4c164345,.c1a36e933c{margin-bottom:var(--bui_spacing_1x)}.c943cc056e{margin-top:var(--bui_spacing_4x)}.e11bafad86{margin-right:var(--bui_spacing_4x)}.e11bafad86:last-child{margin-right:0}.rtl .e11bafad86,[dir=rtl] .e11bafad86{margin-right:0;margin-left:var(--bui_spacing_4x)}.rtl .e11bafad86:last-child,[dir=rtl] .e11bafad86:last-child{margin-left:0}.d44dfae809 .af4c164345,.d44dfae809 .b3783c94f6,.d44dfae809 .c1a36e933c{color:var(--bui_color_foreground)}.be4381a9d6 .af4c164345,.be4381a9d6 .b3783c94f6,.be4381a9d6 .c1a36e933c{color:var(--bui_color_foreground_inverted)}.c8c234d161{min-height:184px;max-height:228px;height:100%;display:flex;flex-direction:row;justify-content:space-between;align-items:stretch;box-sizing:border-box;position:relative;border-radius:var(--bui_border_radius_200);border:none}.cecfb534b8{background:var(--bui_color_brand_primary_background)}.ff1bca3a8a{flex:1;display:flex;flex-direction:ro

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (29309)
Category:	downloaded
Size (bytes):	29425
Entropy (8bit):	5.399183477145636
Encrypted:	false
SSDEEP:	384:0trAHZZ9rHTD1afr5K8mQ70L92RMI7pWrF8ip+fn7g+73+JR+5y+L1nfJ+AKsV28:QrOrHTDBDiMINLtt20XX9Qu
MD5:	1AE2718204931910384CC8792451C25F
SHA1:	04EF6D48770AD295715D0857262D6917E969F28F
SHA-256:	8ADEAA1014B4AAA1FC87469BE843840A58A061DCBB36C958BD5DB3EC3A9FFF81
SHA-512:	BE2A8E20D471717D419820B2A545922EE176EC73D18C6D3E69F2E23FBF75512D0A30879BEBED03E6C8D93BD97A574781F1C597E147D8AF6C62F12E98C74BF60D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.b1e38981.client.js
Preview:	var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e("dc32f6b7").then((function(){return function(){return t("81e13fe6")}}))},"./AccommodationPropertyPageHeader":function(){return t.e("edccf7b2").then((function(){return function(){return t("ccee77ca")}}))},"./AccommodationSearchResultHeader":function(){return t.e("58fc2e19").then((function(){return function(){return t("2e1b6e8e")}}))},"./AirportTaxiFooter":function(){return t.e("a9250ff2").then((function(){return function(){return t("c87e9946")}}))},"./AirportTaxiHeader":function(){return t.e("dd3bddab").then((function(){return function(){return t("5b336c3c")}}))},"./AirportTaxiMinimalFooter":function(){return t.e("51555e66").then((function(){return function(){return t("362aca0d")}}))},"./AirportTaxiMinimalHeader":function(){return t.e("

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	dropped
Size (bytes):	58468
Entropy (8bit):	7.965316284905664
Encrypted:	false
SSDEEP:	1536:9LDIp+d3biZIdqabQacr0M5SlzYhMCR4tL5PlXENRqlbN8:VDIYdmAqaPy0F97ZJEnSbi
MD5:	F26D87CFFF3BF9A03D784279DBF8EDDA
SHA1:	C9DEB14F7CC4589FBC2B08890F0C1D92F6E9DCB5
SHA-256:	4027C476CFD72CCABB6168C85804436D0B1A2ADFFC4928163DACDAEE1A9010F7
SHA-512:	D8DCDA0D21F394E0CA88B3118D4D37578E9E2A6D91B44E653A50A346EB55E84985F35B98D93797C41A1904A24112A09DD1DEC9E9BD1C2E1B123CB5EDD92D4686
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:(..!...I@.E.)1@.HE:...h..%..QE.%....RR.i......(...J)i(.(... 4....R.Z(.(4QLBPii(.(.......P.h........J(....ZJ.`.....E.P.QKE.%.Q@.E-.....P.QKI@...(.(...))h....(...(.......1E..JZ(..R.@.P.I,.....aV.>..W;.N.-..U..&..b1....+...f..J(.....P.E.P.b...@.....J(....ZJ.J)i)..R.P ........@.E-%0.JZ(..QE..(....QKE......JLR.@.I.u%.%.....R.P.IKE.%.Q@....S.(...J)h........ZJ.J)h....(.(.....(..

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.403590365002627
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tJ8/V+/B6dS8p:6v/lhPfA/UJ63p
MD5:	EDB2AA47631C67A43709D4CCD2501E33
SHA1:	87475B448C53CF32FFE78AB121DB8BAB41D478E0
SHA-256:	6019C3C9E47DC991F8D9937DEAFBB0740C2E61E321324798CB508773B0814824
SHA-512:	65820EEAF261F01988570AFE7866D9B83901950DFBD89542009A1FAAAE520E1AF2FA08789B7E94A64B0E1A3BDC39256354EFE1D38856621851DD65E80505DBB2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.....................IDATx.c........o.......IEND.B`.

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	31670
Entropy (8bit):	7.993502656068093
Encrypted:	true
SSDEEP:	768:ZSmnJsWOUrP5k1P7ebijYQyA4BQ4fdC0kQlN8+bYdaGq:ZSmJkUFwjebwyAuQmdZkQokY4D
MD5:	F2C1E7AD49112E82ED4C1F57AB490C01
SHA1:	C34472438A3DAFCEFA5D4759C448BFD09F07DB34
SHA-256:	03116424B4CBAA9472E20A36A16BEA8EFD876F460356C7D7E86894E89414CD17
SHA-512:	D2C55BAC905806E21F47907CE1A04916F5EA80375DE8A43033E5FE02F26AE825ED818BBE4AE3F00553CFFAAB176EDEA2D49BF471D29970E73EDB01B1010E4E06
Malicious:	false
Reputation:	low
Preview:	RIFF.{..WEBPVP8 .{...........>m0.G&$"....x...c..j.$.....6].x.X...u.............}w~..q.................?.....$...O.G..s.....?2...9.)..._...=..3......;..<..O._.}B\|.....>._..#u............d..y.....0.4.?.....41I.>.a..a..a..a..a.....At..d...h...1.g.....;......0]O..6....wL?..i5../.Au.&........F.FAnD.......[ .a%/..J..g..C.+_......R....=.o....q.E..Q...........U.lA. .6..9...>.}...%....`(k@.WeQ...(.CR!.X..p+...M..CN[.R..s..?r.r.D.pF..=.... .............WL_..`I......9._.il...).........!........\j....w..d..?G..".....%z+....Q.fk.$XX.5..D.....@N.O...'......`...F..A.Kdl.sa,..4]<....J.;N...PE......D..]..P.J...B.1...g78...1.d.....v..AG.=.~..3....z..q...4.NL. .f...x.(.....G...d-j.<....R.e[R..9..x....C.?..:.w.b.....j..Yv.5.2-.. ....Z.Z.b..qc.1.......}...pA. ...\|....H,..TZ^..~\|.N@..B.g.h?t1....2^.......^.o......T.......;?..6.W(RD&....W...\|....Q.jj....9.}.O<h]x..+.Y-.......B.E.....@s`.^PH. !.."R...}....`v<.iT.:...tt.....><DW...E.}..s...j.0#........R.K3.O,...a

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65397)
Category:	downloaded
Size (bytes):	1093598
Entropy (8bit):	5.1395807855883895
Encrypted:	false
SSDEEP:	12288:x69RoiKVdDL58g+hcg3bsg20sQUfcMvCR5tfQAMw60FJIW9hDrFlgwcG:xyRodRg3bARAx60UYDwwcG
MD5:	9817BC3E2EDD1E9733AE586D53E7C820
SHA1:	C7144BBEC8351BA157DA968CD6897A3C7007C0FA
SHA-256:	039DFA45092BAA07BA7514F416E1807DD8E81A16F6DD958336729B0A04C635A3
SHA-512:	50A1CF62A9F6A5195F1DD630298DA68550A87F3D2B5CA3794C7066DBA7BFA2F896FAF76B534A4443DE7723304949D9C5D35588753E958CED6259778AB2E6018C
Malicious:	false
Reputation:	low
URL:	https://d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js
Preview:	/! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /.var a2_0x5dbf=['Segoe\x20UI\x20Light','Cannot\x20read\x20SafeBag.','createEnvelopedData','events','Network\x20response\x20was\x20not\x20ok','toGMTString','93d9f6846b629edb2bdc4466af627d998496cb0c08f9cf043de68d6b25aa9693','validateIdentifier','129917vNGnzV','readAsDataURL','pending','getInt24','chunkSize','undefined','privateKeyToOpenSSH','pem','gokuProps','CertBag','Traditional\x20Arabic','Unknown\x20RSASSA-PKCS1-v1_5\x20DigestAlgorithm\x20identifier.','Minion\x20Pro\x20Med','\x20(Relative\x20Object\x20Identifier)','unknown','readyState','SEQUENCE','height','1109354UEGCCY','1.2.840.113549.1.12.10.1.6','Message\x20is\x20too\x20long\x20for\x20PKCS#1\x20v1.5\x20padding.','ActiveXPluginCollector','Nueva\x20Std','\x22,\x20type\x20\x22','https://d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com/d8c14d4960ca/a18a4859af9c','MS\x20PMincho','Century','parseHel

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16321), with no line terminators
Category:	downloaded
Size (bytes):	16321
Entropy (8bit):	4.9193326092478245
Encrypted:	false
SSDEEP:	384:XPTgVJPI5hqsb5QWAI8PRTR53WFZOiOhzK3xdZldV1o8iGEwWLpm40GAC+mrHxsd:9JV8HxMMUx1MMUVMiEMiVH
MD5:	2735211681A8A788CD4DB45244FA1C68
SHA1:	A9BCBDFBF1ABF3A5DF78C24C9A6ED9A6A9650431
SHA-256:	053A91E945434D934D59B68D7A6DCAFC2C8BE9F559ACA7557F68A55FE29D77D2
SHA-512:	CB9E7977D576ADC47BD84D20AB5627E1DA7892A4AAF61C29D47B57D25FF0E85367BCAAA4816B9913A8D1C544ED646EFBA220B40E02C0AAB3BE0F5F110A4DEB6D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/assistant_entrypoint_cloudfront_sd.iq_ltr/611b70b00745fa4412a0101292fb0a1e4c97741e.css
Preview:	.ba-tab{background:#fafcff;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;min-height:200px;position:relative;padding:10px 10px 25px}.ba-tab--title{font-size:16px;font-weight:normal;padding:0;color:#333}.ba-tab--subtitle{font-size:12px;color:#333;margin-bottom:10px;padding:0}.ba-entry-points{padding:0;margin:0 -10px}.ba-entry-point{background:var(--bui_color_white);border-bottom:1px solid #e6e6e6}.ba-entry-point--unread-indicator{position:absolute;top:50%;height:12px;width:12px;margin-top:-6px;background-color:#a30000;border-radius:6px}body.ltr .ba-entry-point--unread-indicator,body.lang_is_ltr .ba-entry-point--unread-indicator{right:38px}.ba-trip-dates{font-size:12px;font-weight:400;line-height:16px;color:#6b6b6b;-webkit-transition:opacity .25s ease;transition:opacity .25s ease;word-break:break-word;margin-top:8px}.ba-entry-point.--cancelled .ba-trip-dates{opacity:.5}.ba-entry-point.--cancelled .ba-entry-point--link:hover .ba-trip-dates{opacity:1}body.lt

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 146 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	7.682854542858676
Encrypted:	false
SSDEEP:	24:d74HzGiEcrffB/6F138cEMRvqqzz/XlYm7rx0ZxgSKoAy7QLWwSe:d7kwc7B/6FecfqqvXlYo0ZZAzz
MD5:	E52554235B2E8390DD41AFCC3E7457B2
SHA1:	CABC89FD270FCBA783077ED3C43A322C68322D9A
SHA-256:	92635446E2AEA633E003497722B76994E131472350BD423B9B3C23EECF7A0CAB
SHA-512:	48F2BFC00044F06FDB844F7BC25489094E007FFE42E4BCEA52DEBF2145A165AD3DADFE6892E1829CFC71514202831AF91433CC7C7821C35DAF8A813BBB56D7AF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......x......z[X....PLTELiq..U..U..X.....U..U.....T........U........U...........U..U..T..............U........U......C8@B8A.}........U........................Wl.K...."tRNS..:.w.e..e=...O.....,..Ep.x....U...T....pHYs................GIDATx...n.0.F...N6.i..5M.....a).....G..FA"G./....B.P(......M.\|..Y.I...)xO.x[.:..:.2(.g...D3...].$1.+y}.d/[H...l..Q.qK.....9...T...g.P.H.~lki"z.D-...W.q../.;]..m.l..j1....%.....#....l).k5$]c1ry.!.\|.......t&.......Y.~iv..........v%....:...`}...i[....R.FWJP.$,.4M.g.w3.R...e-....cp..W2..,...).UJ_.].....Xf...J%.\|..+..J....f.'B......R....3.S.q._..A.1.7.R...n>^.NZ....5....1....7\..IY..3).J.).....{B5.....E!.+.uU7/9....KG)(.pb..bjV..R....F....r^.(!...4i@.......QGu=-RB).2..\|.4...4.z....A...^)F.c.<.>hJ8......T.P.>mF....G..Z......_.7.Bc...V......2.q.]..&'..0<...p.^K.........c...7..V.9<4!D......GK4^K.R.....'..X.3^.,D..dA......U...%:..`\...\9...K.3\|d....uj..A.K......T..B.d.#...~.......Ey.Y.....c.[.N...n

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	81
Entropy (8bit):	4.25597361375535
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8Ha2yOE9HjH2ZmjuJGlyRHfHyY:YGKed2pHDMnEljHMB5yY
MD5:	5AB6D4EF7207325687F427AEF8504E38
SHA1:	511316E2A7BC063A77CEDFBD7CFB906AB78C1FB2
SHA-256:	432D55B2BB99D6C152CE13DFEDA39F61570071A091BC3462FE7400583D27E09C
SHA-512:	DF155117ECBC1567FCE82520A15EF48262DEC52EA3C1F50B00B024CBB15E767B3AB9D24E99D2597686D7FDAF9B8007D9337F7A500DC914A97106C3CD57044EBB
Malicious:	false
Reputation:	low
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	downloaded
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=460620828.1705360583;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar?
Preview:	<html></html>

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1140)
Category:	downloaded
Size (bytes):	1256
Entropy (8bit):	5.247413799252674
Encrypted:	false
SSDEEP:	24:A6UW17xEsRhlMV7xE7Jpy17xEzZuiFdQRJyEeoBxVKQ2qdn:h7xE4hlO7xEi17xEz/kNlVDF
MD5:	6639902487D627277B42C8A94C99C87C
SHA1:	9AC463AB66E8DE3E14C88AAE8C03563558501CF8
SHA-256:	9C30876180B8ADCA0519968C5391A520D11CE841DE6593334EF6965501AC5A3D
SHA-512:	9BF9F50A231BD9FB1C14126A16668203904E034CFDEA8B46C75A38BE26E547750AECBF979C732119EE2138EA510C7019FEBBAA602C120A8AE8FBF24C8F31272B
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/c8a2f0e8.f2766d1b.chunk.css
Preview:	.e49c12619e{min-height:540px;height:calc(100vh - 80px);display:flex;flex-direction:column;justify-content:center;width:720px;margin:0 auto;text-align:center}.c626ca0f00{font-size:48px;font-weight:700;line-height:62px;font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;margin-bottom:16px}.f470d9f909{font-size:20px;font-weight:400;line-height:28px;font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;color:#6b6b6b}.a867464814{margin-top:48px}.f65e382015{display:inline-block;padding:32px;background-color:#fff;color:#262626;font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;border:1px solid #e7e7e7;border-radius:2px;box-sizing:border-box;width:210px;margin:0 12px;text-decoration:none;font-size:16px;font-weight:700;vertical-align:top}.f65e382015 img{display:block;margin:0 auto 24px}.b141d287b4{height:100vh;display:flex;flex-direction:column;justify-content:space-between}.b5c2014b0a{bac

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20730&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=64c0dc5d-700a-4844-a35b-ecd5b1805a50&ts=1705360586269&v=3.8.0-2401042024
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 556 x 508, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	426361
Entropy (8bit):	7.995055894705082
Encrypted:	true
SSDEEP:	12288:Vf+0gAl5XgJAJG3z67xS48hye1uwKhemGO8QlY:h+rAJG147kOlY
MD5:	9F9F09424DC578F5D4CF6889B5037CB5
SHA1:	7424EF2ABD5441B2C3EE11F586184A05656C9A6E
SHA-256:	0C2172A71B8EEAD199900CA18E8F72214E8AED423BC266EC3F0E9B1E416B85C3
SHA-512:	8FD6B790E14B135F750FA92071043C90AF629BAADB822D260B48463B51FFA58FF34632058AE66B388DED6429E1B1E47079CCC8981B454E229A1E5143B2071CA3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,...........[....pHYs.................sRGB.........gAMA......a.....IDATx....d.%....3...@"..\Y..n..p...3....F.s...$W.UYU..pq..nvTyD.."j.t._......9...e.h......?..\|....i.....i....n......}.},...a.~..v.~.v......v...qX....O..f.EV.v].]?8....O...<..>..\?..m.......n.;....?......[..9...Z7[.{.....z}.=~...~_....~.d~{...~]+.s..p...k.....\kM..........9O<...k.x...?_sq.....xN....=..k.......o.....?.u....fx}.X......1>.3^./..;....9.s....=........_.o=...k.....{..._......;i~.3^.....>.q.+........{^...k.[....9j...&..z.n`.3~.}l..^...N.3/>x\....9}..c..................?{X.Y...=t>..5.kZ?.a9>...w<..@[\|j\|.~.g1.+...9..}^.2x.m......[...z.......7;..X..%....?..g...\|i...\|..^.....=6..iM.3.{.C..y\|s..#~.....y...Y...{......c.........q.......pbOi.c.8.~..{...nqM....y...<].9.....{......g..>.z...1>.......k..V...x..:.:....}~.l.......q.h_O.....XX.xf..'.K[...y>.`....'../.x>`..Y.;...M...8q..>.nO...E.C.\|<..\|..yG......@....O6...O.....s......{..h..'{~.d._>b.....o....

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	351
Entropy (8bit):	5.224403476421096
Encrypted:	false
SSDEEP:	6:kWTViYMujkaopqsNE6VVBDq5kh4pIoauwqGmS4ILWZ:kU4u2K6VVBDqNIoauwqGmkLWZ
MD5:	FB137F494A827CC056DA24BE63156F24
SHA1:	BD79642B3AB29A61C739659E202F642E511BE090
SHA-256:	C303642F4B8F347D51FC8CAD4192E2E7BFC55CAE158D3FD692A6105A4CFE5F92
SHA-512:	05AAD8375BE49C7FC7CC467FAC9B2269C41F76AA0ACDCF961EB81C67F1BD394A4BBEEA966208A96521C1100E96A0D934BF02098E1545D92101B9DEB357EF40EC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/18cad957.5bf0bb6a.chunk.css
Preview:	.a48a991fa6{display:none}.c0dd143796{border-radius:var(--bui_spacing_2x);box-shadow:var(--bui_shadow_100);overflow:hidden}.be79a4d7b1{margin-bottom:var(--bui_spacing_6x)}.fd2d160a1b{margin:0 var(--bui_spacing_3x) var(--bui_spacing_4x)}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/18cad957.5bf0bb6a.chunk.css.map/

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.841014016708303
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt0gEi16bP5vsLqo4p:VKEcPw/VKonR3evtTA8O01iGLrwUnG
MD5:	3259D942739B9C07E25675A3049492FC
SHA1:	95041E8A70CF23B17C1F411EEDC9663BC901BD57
SHA-256:	A40DD5CFB0DD11AAB95CF3D51B8681AA1A0D3DCC22D1FBCEA28F26C02FB50A35
SHA-512:	5B8F27594AE3E0603F5E85791824B4B3F5CC92D4DB59E332FC22FE522716936C3BB8DA04B59860EE6AC7A91C3A93A178B907D21E3842EDB16E654325C733AF61
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360575042
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/reca

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	137014
Entropy (8bit):	5.0372726251075175
Encrypted:	false
SSDEEP:	1536:58peWHUB8wKAda616C+kJFPIHX5a0f8l9sdFcg18PLE:6AsSFPIHXtf8l9sdFcg+o
MD5:	AB26A43AF3574BFCB710E10B0C437DAB
SHA1:	2CA82068584D83DB545D665F3A5D8D46B6365B83
SHA-256:	7F70A77C7864D74B2DC38251713740BA211156734BE1742FF0F28CFA1B02F917
SHA-512:	72025CFC0AC11843D02C46912A2B230B6437403D6C95D0288BB35C3B2CF7FD695029ED7ED6E7A43153D890A81865754576A6DBF52B4222BC53DB9A0E9343E4F4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css
Preview:	.bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);box-shadow:0 1px 2px rgba(0,0,0,0.1);font-size:14px;position:relative;z-index:2}.ultra-focus-body .bbtool-notification--top-menu{z-index:auto}.bbtool-notification--outside-tool{background-color:#f5f5f5}body.bb-sr-mo-own .bbtool-notification--top-menu{background-color:#e6e6e6}.company .bbtool-notification--top-menu{background-color:var(--bui_color_white)}.bbtool-notification--index{margin-bottom:10px}.bbtool-notification,.bbtool-notification a:link,.bbtool-notification a:visited{font-weight:normal}.bbtool-notification--outside-tool a.bbtool-top-menu-link:hover,.a11y .bbtool-notification--outside-tool a.bbtool-top-menu-link:hover{color:#333;background-color:#e6e6e6}.bbtool-notification__wrapper{max-width:1110px;margin:0 auto}.bbtool-noti

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1628
Entropy (8bit):	7.784928057284059
Encrypted:	false
SSDEEP:	24:DXGHdcP4D/gO2WdAnzMWSYfJhvbsUT/HZwDN9cbMkfYKjOmJeMs1R2t7UB3:DWHuP4XxIHQgHjbMkwsOTME2GR
MD5:	3E32EFD25AC0214B375FC8A6A32890F2
SHA1:	CD46A79DB7E53E19D5869B3CB3E7AA22EE523479
SHA-256:	807C8A1B498E17D227CF48A640B778BDC4398A9852493CB2F40BF0F33651D0DD
SHA-512:	E0F6807657EE1667876D66DCC13CD279C973EAE35E53509E86EC31951B8B07EBBCB0A1B3FC9BBDBC423F436C1F82BDC5C0440F875092E82A47CF51286CDE0C00
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...[..........2 P....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......IDATh...}l_e...O;......L..S'.G/n..22.bd..s..(d.x...(J.....!....E...%,..2..uceD\|...c.....u.._{[[\Lm3.7.....>/..<...>\|.8F..c...'..=..'{.1N.(.E./.\|......U..#:[./.Y.CY...~.6.X..,..k.F..X...H<...[d....oZ...a.o.T....59#.VL...l,G/.E..y[......59#.c.O..&l.............~\= .dy....2...e.c..d....j<....Y>....wc.f.....3i.3...")..&....b..i..'J!....\.....U....K.0.m.k;.>.o.....1.?i.k...g`.tK...-...U3?64.?...W..d.tl.@~.n.Q.....g...s...........A.V..k.y..>...........,f..e....0.y.... .O.=N..w.t...[p. {.:......N).......VI.Y.uV.....b.,...6=..~...qx.o..j.Cw.vj....D6Sp'.'y.......O..Ml..h_..../.\|...........g.'c....Yq.....O..{../...x.y........o:.WK.....}.,?....,V(..R"......57.,........].. ....<7V....x4t.....a....s1.xo....Q.}.Q.]../.......z..F.v1f......5..qyE.....h.W%{....,..K..[8...\|gE..W.\|w.6....U.g..8..n..q}E.W....S.bo..#y.PxCE......F...J1x

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x798, components 3
Category:	dropped
Size (bytes):	45764
Entropy (8bit):	7.92397187625578
Encrypted:	false
SSDEEP:	768:SUjFjowoptfEN6iBsg+FzXOisfo0ABhW8S0Io9/cnhXPXOmOPEN:SUjFjIpt8N6iBsg+Fz+isfPAO81+xPjJ
MD5:	389F437A3BC267BD2B48BCA42AB30E1F
SHA1:	EEE01B0C154EE7EEA8628E5B6C001AFB71E2F4BC
SHA-256:	10CC90857D634DD1751A441B4D1E091A183225BF8D7A90D1B71BB0A254B8A8C0
SHA-512:	D3F03F2C0A4272CA18651B60DF3BED2921BB2643FEE055A216F18C107DCFD2F4FE87AC1BAD848E042DE3ABC4EFB6FBC683887CDB7880F8CAF18BC3EE28D4D22E
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================........ .................................................................................<;.........................................................0......@....................................................(..........`.............................0.......@..... ..........................................0................!...................................@..... P..@0......@................................................1...........C..0.......................... ........ .8.....!.....0........................!...... ..........,...K.]2B....................................0.....@..q..5...P.cQ....Y........0............................`......J....\|.gX.D....2jE#Z#Tm;Yo..LY`......................................b.*....e.sUg...(.c}Lo.......c].gs....DDc..c...................................ZO!.P..Y..B...WWgZs..o...\....H...

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 556 x 420, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	421074
Entropy (8bit):	7.997500846605643
Encrypted:	true
SSDEEP:	12288:dh4Ok9+LcXMPSrxlu+63SIXsH03WtfYfk5dEO8Onb:devI6CSNl3kiUufum3H
MD5:	A396A8F792199D1D44770BDC84A198E0
SHA1:	1531387C275FE97180347EDD31EB5947F4975437
SHA-256:	9BE7E6CEDA26304F8D24E5D1FB2B8F73C67E0362E262091D36940377E6C2BC65
SHA-512:	995164070CA3DEEA146DB70648254D761F7ACC7F84462C2812376C9373FC88631AC4AD59F3144D90C8B4373B952C0F8FFEB0FA76BF41806BCA0A18FDC194AE77
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/cdata/joinapp/property_full_control.png
Preview:	.PNG........IHDR...,..........\|~.....pHYs.................sRGB.........gAMA......a...lgIDATx.....m.U....>.......C. ...I.IH.q.$..5F.......<..rl......c..&.x..Tj....8v..b.#..@.zB.....{.....f...w_'...;g.W3.7..........w......w..4........!.TK..o?I..;...2.@.(.`.M;..S3.+..].-.z+...o....v...b.g..N.....}.........._.k..L.tu...Vt.&.......i......v..?.?.{t..=.......H......./...M'5].x.F...s.N.+Z7.Z...$.T..U.. R.<...d......$....L1f..+..........6Q...Ue.......Q~..:9.T.{...........7.."..z...-..._.2....S.....C.s..s.._....Y.._.Z..........K.J.fE7.N).......G...=..j..z...rE..]....LM.R...LWx....=w.f.S.......3..o4.q.jR.['....m6...}.6..yxC^.J...:.....o<...~...Sz.[.D5...H.^<w.y..\|.c.r. .Q.}......G._../...'....fM;..}R.9.2UI&.O~0.P.y...2.Lk.....?..1.].5..2&\bk0...=:7.yK:.0?..M"]....d..'n...2..<.r.i....VM..d....Z..;....Ez..=.wE........\|.I..s5=~~B..3....g.1\|..).[..&..b..............]_.&...4....f..L.7...d...Vr..{...y.y..uM..NNO..t!k.qm.K...A.....-[Z.>..xd...j...K.3..

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8173
Entropy (8bit):	7.9436165824193905
Encrypted:	false
SSDEEP:	192:mIk7UsvEuKAktdWdNsW7p1uXbO0JwyPYquqw2K28GrVQ8:nMUuqtdCj11IFPux21NQ8
MD5:	24E4F40FD3D31594B7F7294ABE7B8767
SHA1:	10FF701C77FAAED59B43B446B399D6B1D8534A6A
SHA-256:	95A4B71591982BCDA9FE0848498E3A4E754A4EE3630693145A3AF210BD4A2736
SHA-512:	A67FFB6E0FC075DDD0AF5C656D568E8A0558CE725EE9ED5F1A569AC41E8E19C196FB34129C5885DF966EF8D0C76DBC21D411AC4BFDCAE7A823DF816D32CB5FA6
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H...H....V.}H.?..[..3...r...$.....i...u<.c....\..n#..'hd<..$....rT..+E5.m.K...Rd.....>......T..L....8`9#..zVD...p.....?..O.Ib..7....cH.j..d.r..j..n..Hz....j..f..w..s.............]Q...I.Cx.p_j..C[#I<.)...3.8.j{?.,.i....d...j....z......[.P..j-$....=A\..$I.2..I.8,.dg.[.W.wn%.L.0MT...^...*E.U.<..9.....&.gA2..T..CL.........C(,...V\|....Y..z....,....S.9.XjQ.

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (28231)
Category:	downloaded
Size (bytes):	28351
Entropy (8bit):	5.269749670918486
Encrypted:	false
SSDEEP:	384:Exs69cREmz94wwtahm07+PQiAAXNSx+G+Iq:ks69XC9Stahl+PQYXv
MD5:	045D81F301B4B2739996E7FF2370A865
SHA1:	54399D8B65006E98F6A2B34118395A031FE4C176
SHA-256:	461EA44EFEDFB91213592861ACFD6D994A5C711158760652CABFFF51F1B03CAA
SHA-512:	C6AB7FC743D7C11CD7A7163E85052F1C7A418DD0BD4451D2D0C259CF7E6402FBF1F145D947059EA044E5F525C0B5F16105CD79EB6E3F5D3D0FF3CD08099A301B
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/4ff72d09.17169d33.chunk.css
Preview:	.f8bde84211{padding:var(--bui_spacing_2x) var(--bui_spacing_4x);border-radius:var(--bui_spacing_half);font-size:14px;line-height:20px;display:inline-block;border:1px solid color(var(--bui_color_border) l(75%))}.a596d1fffe:hover:after{content:".";position:absolute;margin-left:5px}.rtl .a596d1fffe:hover:after,[dir=rtl] .a596d1fffe:hover:after{content:".";position:absolute;margin-right:5px;margin-left:0}.bui-button.f73a8d977d{background:transparent;color:var(--bui_color_white);border:1px solid var(--bui_color_white)}.bui-button.f73a8d977d:not(.f256e81e24):hover{background:hsla(0,0%,100%,.1);text-decoration:none;color:var(--bui_color_white);border:1px solid var(--bui_color_white)}.bui-button.f73a8d977d:not(.f256e81e24):active{background:hsla(0,0%,100%,.2);text-decoration:none;color:var(--bui_color_white)}.bui-button.f73a8d977d:not(.f256e81e24):focus{text-decoration:none;box-shadow:0 0 0 1px color(var(--bui_color_action_border) l(68%));outline:none;color:var(--bui_color_white);border:1p

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360584157&cv=11&fst=1705360584157&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2793), with no line terminators
Category:	downloaded
Size (bytes):	2793
Entropy (8bit):	5.9155465181622855
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08hIbmitzYigE3KTz/ZbmgBy:wsbSUtJfxrqLWWWdV6j1dI5lKTzMkXi
MD5:	207ED77F9E927ABBC7270361A20B58D7
SHA1:	04DB040DB496AFB8B3A92A61C906D3A4CC40230B
SHA-256:	08C626459274AA0368B6FF4169E8F106C09CA93792A95FBF948463BFBEE9BEB9
SHA-512:	4BCA94C3B0221983C6B955E662624ED32D4671A416F10B5DB0334910732E5C63E0388335E25F734560CADB1FEB72A9D846ED267029B8F785B8B7D27767DFBBE8
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1705360597923&cv=11&fst=1705360597923&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://join.booking.com/js_tracking?ref_action=index&ver=2&stype=24&lang=en-us&pid=7a96a3baef7600d5&ete=&etg=&etcg=&ets=UETTJbZWMZfPAJNLJPGEbfWEBOWe\|1,UETTJbZWMZfPAJNLJPGEbfWEBOWe\|2,UETTJbZWMZfPAJNLJPGEbfWEBOWe\|8&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1525
Entropy (8bit):	7.814357698865404
Encrypted:	false
SSDEEP:	24:mgUT1nDK2aDPf/6Oa0oYSuAq0gEMWZIePHiC8JRO/S1Q7ZXnrTTnEqtIg0:mgU5nDKP/6OSiWZIE61ovCl
MD5:	A46B40CC66DFC5D0FD0EC67789FF9170
SHA1:	BDF029ECFC539D46FE52CC7D8B5D55478BE969FB
SHA-256:	A5CAFE947DE2C68DF857B8493337A719E97DE77EB56106BF650B89B8AEDE7455
SHA-512:	87FF1DD7314A8764D9224CE2F8CDF469AF63F09D05C8CB482F73A97A25E99623895696E07CFAD0138FA61A6890854044ED291B152BAEE1F29545324C46355EB1
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...[...x.......~3....PLTELiq..U..U.....U..T..T..U..Uy\|...U.Z)..U........T..U..U..T...............y..............(M.....................g`p............U.........V@<$=o..../c.#X......La....;R.............v...._q..)Mn...h..V,nJ5.R0...M......tRNS....k.....U.....4J'.%On...7..B=....a.q\p..]u"+....pHYs.................IDATx..is.:.....v..vS........;M.._.m....E..<.2....#.).....a.Il...,.\|EE.E."3.E."3..[...?...P..h._p+5V`..n..-A.Y..P]...4....x.....H.....R.....j<#...PoGF.1,...s.z.1.......nV..=."K..U.p\.L...........6r.4.+..Z..I0F#<..FfL..a..%....B....Tx..D.9..d...J(. ...p...!.O=..x.X.E..I...$D.e".....+.!.-..~...*0...?..5.y...qtC...M/_..l..}z.u..e_n{VJo...n.{Rna...^.v..........v.!..v.r{)w....[.=Z.Sn..,2KX5...a.8~.....%.0..no.8.3J._.U.n..r/.N..{.....Uh..M._...G..r':....p.g.....q.[...\.....q.B{...8V;....d....no.....5;.>..)...[.....t<.G1G......A..<.d..:....._J..[...?=...4.q.P.s.@.C..z.n..p0%..t...........%.....!.^$..;q.i.L....e...F..u2..+.J\|

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	111
Entropy (8bit):	4.099277144642351
Encrypted:	false
SSDEEP:	3:PouV7uJzhquHbfsGsvziAEtvBL//+ac4NGL:hxuJzhqI4GsbiAEdB6X4QL
MD5:	38227EA31F26CDC0269DA468A2F6CA6D
SHA1:	131E3EF364E2C24812508E7A81C9CB8422AA775D
SHA-256:	0A7C567B36A7BFB198D6F6FBB8B26C0C1FBC557CD4F0FD696835974EDD036F0A
SHA-512:	BA05B3EF2B78DA11134E1FDBADAA1113E11A9DF7148970B8B31A1264CC2A433686D96EF9D00C66AFF4BDAB37052AF3C246C659E4610A2D67FCF7EF106A771303
Malicious:	false
Reputation:	low
URL:	https://static.criteo.net/empty.html
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <title></title>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o=
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (966)
Category:	downloaded
Size (bytes):	5456
Entropy (8bit):	5.334135683627294
Encrypted:	false
SSDEEP:	96:1GInbH6vTKvmYDDaLVxLobF5rZQlhaPr66PHDf/H4QgG+vylylqn/Dg1judjai:kIn7+TKVDUibF1ohanHDf/dw6clqn/DH
MD5:	6A6C840261EFC198792C2965D02191D4
SHA1:	41FFE077DE423A6CB8B361F69A2C4F4589F9BBF1
SHA-256:	BD82B4A0A0201BCE49836C82595E09A383843C98AEF27C1C500AC514D7DC42A7
SHA-512:	BCAFB00EA7CD87735041D8234A16C0DF38710C9E7744AF3C0FC98918595AFECE155A11FCA238B348F90922F9F52FCD8917A8FCD2CAE611459C5F6AE79DD2D952
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/04f32d9e-1729-4d42-82b5-91c2350ff323/OtAutoBlock.js
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.2781425644004125
Encrypted:	false
SSDEEP:	6:w9NARNMJjQykRp6bXN25xBRZVXokLVEXNBezVL1Eh4pIoauw4dDOZ:qARsYUzN25HRZVXokSXNBezd1HIoauwV
MD5:	F1D67C93F1232808B430D12E5D784B19
SHA1:	E7BD4213A07D1BD54D07114DF90ED2D9A67FBC18
SHA-256:	113446BEBF9C745A55DAF1414AAED1672AA899C0604CAE103D5ADE7C38190F6D
SHA-512:	6F11D05CE7A2B8BD7C7131FA6931EA8E68679CE97DE13F391E98D7D5C4EE57DF11BF96688E75C31D13434A7AE49FA1C72B64D61275F07457EBE536D066167781
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/43e47265.9fb0fb7a.chunk.css
Preview:	.fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-line}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/43e47265.9fb0fb7a.chunk.css.map/

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	76613
Entropy (8bit):	5.616201814574669
Encrypted:	false
SSDEEP:	768:Sb6yYelZ6jfU0E7eylJe8z+kjw0lIDGEZbgk2IXLxY7t9/ytTC9b0fAiKa9KX+Xu:tU7INHFKX2a3fHQs
MD5:	7ABA25D5E19D0DBAEDF567CDC2BF48DF
SHA1:	EE9A4E7B596B73F4DCCE8EFB17DC570FD480D6E8
SHA-256:	8FD21C75C8E220E351ABA0B5F314CAE2F0CC793C6A324BC61DB2F961C91DD578
SHA-512:	F745A0068B84C6A235603EBCA6DFF1B265986583566BB9ABF46410B76A9D50E5FF9F500786BD417643C084E6E9ADD8E58894C684153CAEE04CC529C37EFCB581
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",1,null,null,1,0,0,0,0,"height",null,1,1,null,[138453373351],[6409064327],[5207250927],[3265750934],null,null,[764188],[12289587],null,null,null,0,null,null,null,null,null,null,"AOrYGsl2q8RyF6V_dTp6r3caMlMoTn4vwmxUlVHbEeqO4ktde4gjFqCJpESbuQGLeIhTJ8XaJwCPi7hCCYWvlKRRdWu7Dd7M4mo6ag","CMvWtq_D4IMDFXU9swAd3KAP2w",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPKf1vqw6OCO-6mTJcHLchuBuih3278G4fuF_BzoJhs0o5q4zoP7pQz9cYPKvD7vaAHGK6jeObI32irPQaik_y2GLGB-PXDt1snj2l_tqL48iprb_A1BWHaC28FrQOnRW6gnEx-lbMDVlkNIH-u3iBmwMy6hHhHD_A30vOAFdYAAELVWgOBY_lNFlQFlznqMWeA89Cx-T_ykti0wYOoKNc4fPPEH8k4_P6fwmDK7HJt5sOUAM1VD9Bsv7fBr61a-fEnz1GZN2mC3ZKfNLQ7ZjecBlZFpjqD9FNPbKqeAljPNLKRhbtH--TGOtN0QnYscSKgt88mm1mwVA5PyeSG6VeHg_iBcIMT"]}.<!DOCTYPE html><html><head><meta name="viewport" content="initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><scrip

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	491
Entropy (8bit):	4.647816615642696
Encrypted:	false
SSDEEP:	6:YNMa9YaeRbUHjG2+z/iJ2sIwKWovDop+T7eKNNKJzA1:YNNGa0+CXz/iJIxvD/JNNK9Q
MD5:	B62D7C239CCD9CBD7C795FDBEFCEBE33
SHA1:	BFF41E89CA97CDBECF3C7F777AB8C2AC48E91FA6
SHA-256:	5B225489941160E3E799795C74DA056CB00C93A7A79082EA26303003A1BE7461
SHA-512:	05266109A823EC445F33C4C87D03707DCC403959A5062A04E153CCD5D97EC691A56B52A30B05ED621D6BD323F76E4D0F46FA4869072EDF16F04DFF325B23919E
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1277477425375320&correlator=972839179899800&eid=31079956%2C31080295%2C31080441%2C31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3Df026c47f-f6c4-460b-93fa-1f2190c83402%26affiliate_id%3D304142%26rendered_ad_pageview_id%3D7ceca3a89c6d001e%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3Df927aa320290b431%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ&gpic=UID%3D00000db788c26b0e%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA&abxe=1&dt=1705360597396&lmt=1705360597&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=124&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360597&ga_hid=1177479985&ga_fc=true&ga_cid=1111547412.1705360577&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360593187&idt=773&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1126437992&frm=20
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CPGaoqXD4IMDFRYJswAdSAgAZQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qM0Po7TXXRFl4hYS9dToueZhwxM7sWQwgTdrKKPc72RmwUeg68tp_0ko3-AAJJtMIpOXwufgUtVKUwGa2P-FjsEGhm4nw"]}..

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5036), with no line terminators
Category:	downloaded
Size (bytes):	5036
Entropy (8bit):	5.02691899528761
Encrypted:	false
SSDEEP:	48:ocwvvR3dn37Kfdx8zf0SBcqGeunymhVRl8hOfEwz4EwEgrTH5exO44H:CXn+fLobBjGeunyma8gN9gOF
MD5:	9478D8D20743C0422A70FDDF04DEB7FA
SHA1:	4D9B919969BCFF2E4E39E7D008A7A0C3F39ABDA1
SHA-256:	F9824E5F4727F34DD4B3F268CC3A51970A763E2E54FBE9934C44B7FFC1159E8B
SHA-512:	68206B543F68B46EFD8004FFCCB156CF3C3ACCB368137CC0228BEBC743E5B2A71CEA35DE6E27768ECE09C0FFA824D2CB33B1FEA7C48655ED012AAF4BF374B62E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css
Preview:	.logolink,#banner_text,#tagline,#b25newName,#tabs,.help,.helpSmall,.browse,.but,#moreDestinations,#rssFormInc,.placeholder,.noPrint,.popup,.calender,.search h4,#sortAndDest,button,.scoreBarImg,.prevnextbar,div.top,.hotelnav2,.smallImgArea p,.curConv,#currencyConverter,#footer div,#footerbuttons,#footernav,#showReqRoomsHeader,#traveljigsaw_iframe,iframe#traveljigsaw_iframe,td.download-buttons,#bookStageNavInc,#mailafriend,#bookProgressBar,#languageselect,#calendar_popup,#netPromoterScore,#newslettersubscribe,#subheader-wrap,#registration,.breadcrumb_usersalutation,.notice-wrap{display:none!important;height:0!important;overflow:hidden!important}#bodyconstraint-inner{position:absolute!important}#top{background:0}#footer #footercert{display:block}body{margin:0;padding:0 0 18pt;color:#000}body,table,td,p,div,ul,ol,li{font:10pt/12pt "Arial","Helvetica",sans-serif}td,th{vertical-align:top;text-align:left;padding:3pt 6pt 3pt 0}.figure{text-align:right}h1{font-size:14pt;margin:0 0 3pt}h1.specia

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 556 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	421074
Entropy (8bit):	7.997500846605643
Encrypted:	true
SSDEEP:	12288:dh4Ok9+LcXMPSrxlu+63SIXsH03WtfYfk5dEO8Onb:devI6CSNl3kiUufum3H
MD5:	A396A8F792199D1D44770BDC84A198E0
SHA1:	1531387C275FE97180347EDD31EB5947F4975437
SHA-256:	9BE7E6CEDA26304F8D24E5D1FB2B8F73C67E0362E262091D36940377E6C2BC65
SHA-512:	995164070CA3DEEA146DB70648254D761F7ACC7F84462C2812376C9373FC88631AC4AD59F3144D90C8B4373B952C0F8FFEB0FA76BF41806BCA0A18FDC194AE77
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,..........\|~.....pHYs.................sRGB.........gAMA......a...lgIDATx.....m.U....>.......C. ...I.IH.q.$..5F.......<..rl......c..&.x..Tj....8v..b.#..@.zB.....{.....f...w_'...;g.W3.7..........w......w..4........!.TK..o?I..;...2.@.(.`.M;..S3.+..].-.z+...o....v...b.g..N.....}.........._.k..L.tu...Vt.&.......i......v..?.?.{t..=.......H......./...M'5].x.F...s.N.+Z7.Z...$.T..U.. R.<...d......$....L1f..+..........6Q...Ue.......Q~..:9.T.{...........7.."..z...-..._.2....S.....C.s..s.._....Y.._.Z..........K.J.fE7.N).......G...=..j..z...rE..]....LM.R...LWx....=w.f.S.......3..o4.q.jR.['....m6...}.6..yxC^.J...:.....o<...~...Sz.[.D5...H.^<w.y..\|.c.r. .Q.}......G._../...'....fM;..}R.9.2UI&.O~0.P.y...2.Lk.....?..1.].5..2&\bk0...=:7.yK:.0?..M"]....d..'n...2..<.r.i....VM..d....Z..;....Ez..=.wE........\|.I..s5=~~B..3....g.1\|..).[..&..b..............]_.&...4....f..L.7...d...Vr..{...y.y..uM..NNO..t!k.qm.K...A.....-[Z.>..xd...j...K.3..

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 93 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	561
Entropy (8bit):	7.415138128865445
Encrypted:	false
SSDEEP:	12:6v/7d4EkqImktpO/6TpyIKOjtpQMjypdWospz7TaD8imYhj2QQ:urKmk6/6NyA2ovpzXkmYh27
MD5:	C56550144E45B5BA82B2520F84BF24B7
SHA1:	DF44D7E2ED25EB669864C37B98AB6E6F286F7CB8
SHA-256:	66A7D415573A91B1AB1FAE594B4895038BEB3DB1E5856D56236E4ECA8D741BE7
SHA-512:	A41B5A62BD69C1BCDC26B84F20E1E976227C9640C34B6D5BE30A6E5051C3678176CEE0F4DA800725892B6054F1BB09A4FB7B916A2311E071E70B769ACF60A28D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...]...x........t...TPLTELiq. W.5g..U..U..T..S........U......Yp.+Dx.....U......5N........t.......<.................tRNS.?....Df.6.........pHYs................iIDATx...ao.0...........=...%q.9.e..a...R.Z.,.,....)V.L/Wy.X....-Zwm.+..i..5u..1mJ.6...w....u.....6@<..C....A..d0....(.$..........t.Q.c.Im....g...S..o.#D.......N.....W2......H.\|.`]...../\|8..............Sz..l..\.A:.e.>iHi.C&...$.L.e..){..'3.D...d.l.\|.../\..o........l2.Nf..l?.....>U...[.q?..3x..Nq.B..}..a.W=.../d.Y.&...MV....n.K..eY.{./.....X\....IEND.B`.

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	242858
Entropy (8bit):	5.461227371865888
Encrypted:	false
SSDEEP:	3072:nsu6n3pBwGD5d9uFhM81EvYyoJDT02D/QBCnZxMk+VFI/axewInK:x65Bnj9gyoJDT02D/ukXMk+VFI/axcK
MD5:	AE44BE688B595AE541D873CBDC5561AE
SHA1:	506F7E10FF3C457B0EB7DD492607D395D4AEFDA2
SHA-256:	881A3D9C06D274AB62B9882CF76A563920DC4AF4FF3DDF21057DCDB4DE200F4C
SHA-512:	4C5D1D416678644A5A248030942BE7E9435E8512DDE36EAC893CDEF1ED85E98B0D0F6A842BF33967FF2E95C20743A1F9DCE70E56555701BDD40E3AF4E3725B0A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/pega_cloudfront_sd/2c9e180630f6e71e0eb0dcf243984b749e769642.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function handleMashupOnLoad(){_i_("161:533e159b"),document.querySelector("#OnlineHelpIfr").height="99%",setTimeout(function(){_i_("161:21d72029"),document.querySelector("#OnlineHelpIfr").height="100%",_r_()},1e3),_r_()}if(B.when({events:"ready"}).run(function(e){_i_("161:57ee888a");var t,i,a=0,n=!0,o="chat-session-connected",r="botf2f94a87400545009c393108e2368ac5",s="BookingCSSelfService",_="https://pega.booking.com/prweb/PRChat/app/BookingCSSelfService_3465/",l="Live chat with Booking.com",u="PegaCA-Work-ProactiveChat",c="Work-Channel-Chat";function g(e){_i_("161:6e946639");var t={AppName:"SSA",HelpConfigurationName:"botf2f94a8_bookingchatbot",CustomerURL:"General",pzSkinName:"OnlineHelp"};return t.Language=window.navigator.language,t.hotelReservationId=sessionStorage.getItem("hotelReservationId"),t.supportRequestId=sessionStorage.getItem("supportRequestId"),t.triageSupportRequestId=sessionStorage.getItem("triageSuppor

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25550)
Category:	downloaded
Size (bytes):	25662
Entropy (8bit):	5.472581330939158
Encrypted:	false
SSDEEP:	768:6i0MeaUPgjda/bboQ0gJd3HFFdj/t6/+40K2Qy+iY4zU:R0Mea5E0c3FDj/Y/x4o
MD5:	6C724CB3AB9CBECCFF5D0251367F5E7D
SHA1:	9CE66535EF90E35E428D4CFF629AA21A0ADCA8B9
SHA-256:	7117D4867BEF3326CB54265935BF4CA0348717638C82B56A37CFB25800F76D2E
SHA-512:	980DF4DFD20895BDCCC2752C15D98EA51D33E13742A599D1B59DEE34022D03F88432F4FDFDFC0A1E28D66AE8F20B30543EBBE0F45FE12ACA1498432554E3CB59
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/a6a21c13.3e4975b8.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6a21c13"],{"34827c64":function(e,n,t){t.d(n,{M6:function(){return a},t0:function(){return c}});var i=t("ead71eb0");let a=function(e){return e.WILL_BE_SHOWN="WILL_BE_SHOWN",e.WILL_NOT_BE_SHOWN="WILL_NOT_BE_SHOWN",e.LOADING="LOADING",e}({});const c=()=>{const[e,n]=(0,i.useState)(a.LOADING);return(0,i.useEffect)((()=>{function e(e){const t=e.detail.willBannerBeShown?a.WILL_BE_SHOWN:a.WILL_NOT_BE_SHOWN;n(t)}return document.addEventListener("cookie_banner_loaded",e),(()=>{let e=!0;return window.PCM&&1===window.PCM.isCountryNeedCookieBanner&&window.PCM.isUserGaveConsent instanceof Function&&!window.PCM.isUserGaveConsent()&&(e=!1),e})()&&n(a.WILL_NOT_BE_SHOWN),()=>document.removeEventListener("cookie_banner_loaded",e)}),[]),e}},"0f5c0451":function(e,n,t){t.d(n,{Z:function(){return m}});var i=t("dee2534d"),a=t("ead71eb0"),c=t.n(a),o=t("04fa1900"),r="b2ca975670",

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38536)
Category:	downloaded
Size (bytes):	39518
Entropy (8bit):	5.651460640507762
Encrypted:	false
SSDEEP:	768:jhNblGwIvmOJpbYgZtswi/27kG4HNVsavgVvw2GAtIINUMRr78GoW+LGtmWJejlE:jLJymxzXvokALI3TweflWAPIN3
MD5:	5024DA521CD4CB88E7D364C7DDB93B4D
SHA1:	301CE4301453F6E8D100247F120B15510C744815
SHA-256:	30216B447644D7908A8EF33A44BC268E0B88EE6AA1D379B9E80EE803D189362F
SHA-512:	04D37C30263E6C408B6A865383AB804C82BAA3FDFA1A71D92AA99CCB286B8C69EE824D07992BFC072DFACFBCC7ED8F2CFB9ACDEBA4493A9213D5436EAD3FFE72
Malicious:	false
Reputation:	low
URL:	https://pagead2.googlesyndication.com/bg/MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8.js
Preview:	//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==. (function(){function C(X){return X}var d=function(X,P,L,q,G){if(q=(G=t.trustedTypes,L),!G\|\|!G.createPolicy)return q;try{q=G.createPolicy(P,{createHTML:u,createScript:u,createScriptURL:u})}catch(c){if(t.console)t.console[X](c.message)}return q},u=function(X){return C.call(this,X)},t=this\|\|self;(0,eval)(function(X,P){return(P=d("error","bg",null))&&1===X.eval(P.createScript("1"))?function(L){return P.createScript(L)}:function(L){return""+L}}(t)(Array(7824*Math.random()\|0).join("\n")+['//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==',.'(function(){var O

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2324), with no line terminators
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	5.8943027441048725
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08xrAcSatzYiglH26:wsbSUtJfxrqLWWWdV6j1ZA+Wj
MD5:	46642E087428C00344EF4D1E4DFF49ED
SHA1:	A716D5F236BF03E92F4F0BE5C2BA71D21A6CA74B
SHA-256:	6FC6897C27F7E2BF5C27B45B684871D5F9F094671B8201677AE89520C5AE9BB5
SHA-512:	9C3587F8A3068F41703442F960BCA04EC9A905C225C8E575A9423FA84160E7FDFC3312A9C62E51CE090FEFAD0C947205A479829955685CF8DA0BC566D4C3D6CC
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360598000&cv=11&fst=1705360598000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	downloaded
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	7.926541742311065
Encrypted:	false
SSDEEP:	96:rIGMcponR70HgyaFrym+U95ICrxP5rxwSlA3hf2ZMAo6y:fFond0HgDmDCr3lm/D
MD5:	38784D782A29A302DAB9135D63AEF953
SHA1:	04DB0E863A35062A355C4B2EA9585EC83C4FFC3E
SHA-256:	8561E200A6A57195E480ED9D893B14579EF6ACDEABFBB3FE22B5E4EC9B84B455
SHA-512:	741DC6204353821D6CB76E16E36AF4176C1518EFC22AB064BABAA0D21DDB8BD9BA5A08F10A82D899DF3D880E5AF8BE76037CF342813D0D22A02A9558AAD12C67
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...m............/....sRGB........OIDATh..X.pU..>........(* .T......V...Z..m.Nk.."..CE..M\|..(-K....:.X.....Xd..P.(E.B.{...;/.&.3.3.3.;...;.?...._.%.8....("PD..@..".E........#..7.K.?.Q2.Z....=;......)..1.\|..,..n.\..,......R=/U<...../F...:.].\|>Q......O...#>.RUV^.\|.Vb.Q..%k.RB.a....8........h...O.=...Yu...q2.6.y.9...R~...@...2.........X.R..._=.../.\|..=......q~..G.{..w.......}.< g.#..!....}#-.........2...8....k.r.(.g........'..1...XF-..:...S..#..qny....%6.y.....h...GF..rMr...o.@f.J....../.+.}.j.G\ ...?.>..j..x.Q..a._.....(......(.i.xky.......tGGE"..BiH+.__YK7V7D...'.I..d.N.oj......c.$#...1..........`DV5...x....c...$...1..r...#...)..n..T.....DzsucX.<=.1p.....G&Q..............3.k\..4.............l.Q3.".t...WE.).i.O.U7.5...'.j..1.o...u..DT.d.D.W/.....T5...G.R.Cb.vG...B.Q2X..../s:Wn.. ......z.1.k.9...Y-......F5.zt......(...I~.....~..:....^.k.8!R.~.x.H.W.Y $/W#.*DB...[<.1..U.E....Z.-..F.n.l._e..d.q..6C.k\|..8.......j.$....

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36232)
Category:	downloaded
Size (bytes):	434117
Entropy (8bit):	5.514060210084827
Encrypted:	false
SSDEEP:	6144:FjnNej3jOjGjCjZCEY2rdARQvXM4z2tmYu0KC246zLVrktV9eUIR+U+ZFHt:DCt2rZfM4zmvu0KC246zLVtRx+h
MD5:	982904A4F27641C9BEE91A853C0494E4
SHA1:	80F8AB7FB43256C0BA6D0A867CBFB66DACE0E519
SHA-256:	70A681947DCC0080D6B1473C9C7B18F46D39F889480D8D0A25F019A467D06BAE
SHA-512:	6303F2D687D46C5F7521B6D8D0FB4A7593754028BE17CE01E6815930F3A90088A5384F6DAE68289BB0EEF4EED0B172E3C09B9E56E5BADA1C4B6EC9FF357DAC06
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-5Q664QZ
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"300",. . "macros":[{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"action"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"user_location"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"opt_out_companies.facebook"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"fbp"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"site"},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"n_b"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cul"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"dest_u

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
URL:	https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-1wMWlUwC227b84Dh6MIXwLUNPlLjltDvVLpfEw
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65033)
Category:	downloaded
Size (bytes):	65226
Entropy (8bit):	5.498630035870181
Encrypted:	false
SSDEEP:	768:ulUUOd7sBA0/UAC/ywu4GjIHWIFa1R9riMzLnApxE8CB1LS3Yw6RZnM2+BtSYIE6:sO0CKfBRAYw2LqIbWURBYcb
MD5:	2A4BE84FACF3E21BB4A9EBB12A10A92E
SHA1:	E03A6EA6313A52CBE9685A8617465E307E471B79
SHA-256:	CCE0256A5EC747F4C0BF5339FE4870FD26B19926BB9E984B5EAA8FFF9AD160C0
SHA-512:	73B06DA27D26CE38EF0E03FCD4F692020DC599C96C8CF75A12D2AE9CACDB6DD0A4A86D38CD6612C4355B1EF576D498201DDEB0B9EB489FDCCC9EF3842A5D0421
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js
Preview:	/! For license information please see f5d0e2e7.5cd38fd6.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f5d0e2e7"],{af1e2b38:function(e,t,n){"use strict";n.d(t,{Z:function(){return r}});var a=n("6ee88c54"),i=n("dc6d28ff");const r=()=>{const e=(0,i.getRequestContext)().getSiteType()??a.N.WWW;return{isWWW:e===a.N.WWW,isMDOT:e===a.N.MDOT,isTDOT:e===a.N.TDOT}}},"4536290a":function(e,t,n){"use strict";n.d(t,{G_:function(){return i},Jh:function(){return s},er:function(){return a},tD:function(){return o},zW:function(){return r}});const a="https://bstatic.com/xdata/images/xphoto/max300/155161147.png?k=d70408f26332684fc7ad8476baf145813e2e71a7d8d89a40645bcc97cda6f00e&o=",i="https://bstatic.com/xdata/images/xphoto/max300/155161149.png?k=02a71e2df8269c8f9783c405dcc3854ef4a727b739a7202aed1caa64dae5141a&o=",r="https://bstatic.com/data/mobile/gneius_vip_logo_with_ripple_v2@LARGE.png",o="https://bstatic.co

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53586
Entropy (8bit):	5.539492928652157
Encrypted:	false
SSDEEP:	768:A36XlD+tm7nisw8TlfInB3WzrUEABvtiR3/wcJlYRfGkuF3QraRqJyCWrctKCB:A36XlC0TNNdNQbtip/wSlYR1vlJF7B
MD5:	F9A118320C5EEAEAF317CD40F3E7AECB
SHA1:	A74A9FC15452095E48A045DAAA420332752EAB69
SHA-256:	7E821E0AEC9F19EEE04B3C9026BC4D58738D17493798CD5035C7774012DA6368
SHA-512:	3194B39D53AB12780D2456F0FF343EE13EA13899CC24D91377059F9FD26E7052B02A50B6691EB254D7DB4B24DAC6BD1C468DB7311F001436C63A351240B6990D
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5978)
Category:	downloaded
Size (bytes):	570411
Entropy (8bit):	5.935045085984227
Encrypted:	false
SSDEEP:	6144:Kz6GsvoSIeOYva60IrrR0CWzTRKtpIYvZRDQQ1AnQhSqChQMJH1:KECtx8+TT
MD5:	1ACB7F6E26A4C4D8B1B4D42755777C51
SHA1:	67C31A7D836FAB93E89DFFFCB38FF14125553620
SHA-256:	496EDE5142D4CBB99F06CD9C90AC0BA7EE0FD556F9AE4A7EBE29F9FA9DB1322A
SHA-512:	905FB4BD8E7B8F96307E05848C49FC3B697EC99E7EFA7FB28C6E6CAD97959B9B937B476478038219B867BDC0D7E3AE685F47B933BD09F58AE8538132D2C22820
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/
Preview:	<!DOCTYPE html>. .You know you could be getting paid to poke around in our code?.We're hiring designers and developers to work in Amsterdam:.https://careers.booking.com/.-->. wdot-802 -->.<script type="text/javascript" nonce="J7fxhjkLQcxF175">.document.addEventListener('DOMContentLoaded', function () {./*. provides the current user's cookie consent.* in order to use it:.* 1. inline privacy/cookieConsent.js in the page you need to use it..* please note that this library relies on window.PCM.isCountryNeedCookieBanner to be initialised.* before using (calling getValue function) it.* 2. in your js file:.. var privacyCookieConsent = B.require('privacyCookieConsent');.* var consent = privacyCookieConsent.getValue();./.B.define('privacyCookieConsent', function () {.var consentGroupIsAllowed = {.analytical: 'C0002%3A1',.marketing: 'C0004%3A1'.};.var optanonConsentCookieName = 'OptanonConsent';.var optanonBoxClosedCookieName = 'OptanonAlertBoxClosed';.var halfOfYearMillis = 180 24

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.493473304203662
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8Ha2yOE9HjH2ZmjuJGlyRHfHyI:x2pHDMnEljHMB5yI
MD5:	4A7E157A6DF07A8F848E13647A1F50BD
SHA1:	95E2715124461E84FB01E75A2157917697670D6D
SHA-256:	E45C44615E141491E0540FEC7B7A8BE281D4E63E22D71E9F28F8295497C7FB51
SHA-512:	667B25AD6400C94F4E53A2A1664FBAEFE33E9ED236E3434095F83D53AD072B66D97535523F7761EFA9DBF8D8A2618ACC91886748255712E78094C6C3DBE64397
Malicious:	false
Reputation:	low
Preview:	jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	4615
Entropy (8bit):	7.887291203009579
Encrypted:	false
SSDEEP:	96:ghIEEnSeKY34LPYVtI3cD/Cps3rVl7vlbsLIsp6I3yRBXMBSdB:mIRSjC4jYVO3cD/Cp8rbJeIkyRBXMBSL
MD5:	EEC80925CB2599C34CE7C368DEF9EC9F
SHA1:	094AA6CEF6670AF0138A3BA97E67D95977E589FF
SHA-256:	5393D4458AA47507C1D1335A36934585FA44F0F92CC2F71627D359D727978793
SHA-512:	2B95B2434E2A92DEE4D01BC1D8FA1881AB0789C8F0F2CABF1037AE7020BD1FFFA60F20DA43857EA8A4FF6C673C5AFA2B67D50A9C4C446107A52C0B319FCCD4C5
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/689588.jpg?k=67d1fdb867d74cdd3a5c6adc2558ff14c165b55329efec5109e5cbea8743aa6c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...F.m.....+b...}..).,A...6.6.qX.e..m....!.F.m...;.....vR..b-.m....p...P...pZ.;....R..E..[(.Sm..J.b...`.m..a.h.Sm.m+..A...>.M.\\..)6U..l...A...>.6Qp.!.F.m.}...HvR.R..b..l..Q....e;eJ.......e..%8%+...e..g.......)vU..."..OSJ.h.U..A..Mrb1..o...........Q...et\..o.....e....(.Vv{Q..0X...eX.F...+..V6Q..a.g....jP.....=.vU.,.....+....t.]+...).q...J.b...=...j].\

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 520 x 340, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7367
Entropy (8bit):	7.954867954128154
Encrypted:	false
SSDEEP:	192:mJHKhAqXcsI/5FTXVJzcT76KNRsN74HTwC9v5cAlQSPgGNNp+C5fKQ:mBAAqXcseFTXVs+ERsYwC9hcm40Np+6x
MD5:	A2BDD966488047AAA17DCEBC5238432B
SHA1:	65C52EEB866EB2ACBD183E5FB2DCCC5205DBB6BF
SHA-256:	CFC71DCDDDA21B32C0AC5BA5322BD41612224261FECDC38CD20A45B6B502457C
SHA-512:	CC6450163167C4659D80D885B5DF1B281AA819C7DC9780D7F874664FDA29C922437E6E6FEB84EADB3900E40B4D0D7441B08369A0F0BFCCD02040B47577745E3A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/media/world-map.7d457a5d.png
Preview:	.PNG........IHDR.......T.....v.4@...lPLTE............................................................................................................G}.x...$tRNS. 0@`p......P.....pP....0.._/o.......9.....IDATx....b.0..p..R..a..z..d..P....../7........:.!.......G.INU.....c$.c....^..=..I.^Q$8.S..n7...3.H-.;D>TY.u].....?.a.}LI..XW....\.......G...bf....Jj......y........F.)....!..p$8p.b...-.^O.X.......l=...$.......6..i.........T;...#..O.L.w.6.......DT.t......g.R.R...y.9...I1.....G.N...V.gQ...:>/}.j.T5.?.WvPR}.DL0.....l.....VV).0..\|.H..P.1.%.k....m .....=e..UI5..0f.).n...+{3.nP....`f.0...R../D.I.].E..0n8.....x=......j.?R;Rmd#W5.%..x...59.j..p..j...F.C.%...$.....o.dg.C.,v...g.....b;..T.)..#.%..$......nT.C..:..M.~..GCU...\6@.D.&.aJu.g#..../2<.~n.h...p...A.R..^_..].D.I.5p.At^.O......AI...._....R...a`_%.0.\.d....tp0......BR3.@...8m...X.\|IZ.T.@..P,...7.r...%...\|...a..v...m,..66.L.mi...35K..X.....s.MH....s=~.<3......g.R..tV..Sy*m.....t'.S1..@.cP{..b..-..U...ac

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	31784
Entropy (8bit):	7.9948303468433854
Encrypted:	true
SSDEEP:	768:05xAOj6x2mpNztEaP9wVzjDsXyf5ZArMLWCddKVTWe2:05xAOj6x28J7+VzjD/ASW8XT
MD5:	F7D32E8ABCD959E1AF6E05F8D7A515B9
SHA1:	BC2DE937153625E6E5C76D720FCB512BF249D433
SHA-256:	02C9AD6D3A1C9456039B7DC5279EBBBF831E3FE3890D125C0D19A1E422F7ECC6
SHA-512:	22FF79E353E50295F5FEAB2E140FA104D74E87DAD20D47744A39DC6F0566E6DCEC988952570145BC67524E1C278DF71D05AB25C89197C957503F87CD7EFF2A35
Malicious:	false
Reputation:	low
Preview:	RIFF \|..WEBPVP8 .\|...........>m2.G&$#!.V.P...cn...&C....O).....i9A..6.{.._.>5.......{'{O........q.p.z...\.Z...q.w.O=....q~......?....o.?..+.s._...<e......`.............7....`.w~../......\|..K...g...?......3...7.'...?.....yo..................Kk.Lw...f....f9I+..s......dk.(.&<.g,...k..Vh.....j.p.4.;....0....P...Tz.,..Z....\|.gP......"z~.W['yM@+.d......1.c}.....IE.9.d........<....q8..............D.\|o...N.....W.>}.......Q0i..-[.}.P...d.'.Ja..N. .....p.kz0. ..,...uM.V.[..=...;.....{....pUF....K......=oF..P.9....\....X.. .4N#U("l...x-..v.......~.Zc...j.S..T^..i.8.......<.?..#..O!W.......1F..E......V&a.2.z.S.I..O....=.]..u..x%j.(.G.e..Y"-S>....uK...`3p.bD..1a..OuQy.n.50."..i..h.).8....g4C.+...`.<Av^...e..*v.e....K.$..9m.,...K.I8d...5.h...b.w...4.W.Y...+..#+..uW.s..... \..[t...J...D.^.....yabF.G......L..Ity...G...'.......\|.z.5.n.M..zQ...F.X$P-...<.5.?.m...i...R..A...kz.....[:.]p.H.+]...[..&..e.j6.p....c.7..'........;..1B..R._Z...1...B...'S....<....

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21501)
Category:	downloaded
Size (bytes):	21613
Entropy (8bit):	5.293061193633834
Encrypted:	false
SSDEEP:	384:9RMgImVPPokFljq/lvuMSCItjpo3PlRp6iPy2iQCbWLHXaNLQV:9RMgJVPPFFVq/FopYPlLjy2CWLHXaNLE
MD5:	EEFE1BD68506ECBAF7AFCEE3DDCCC7E4
SHA1:	583B81C42499C16F5BE9F2E6E2F6E2E93DB01219
SHA-256:	65879CFCF6E40111BFD6D4AA845D1B349853A474EDB76DD91968CC5142F6B945
SHA-512:	2E12326EB8CDF06BF55796BBDCA3D545DC8054D43788198460ACCBD3A517F9211A8D864F5D02BE26A179D8D0FB7D1D662C0AF00BD8CA5E25ECFDC2E9BF4832A4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f50a2dfc"],{"22b0f37c":function(e,n,t){var a=t("3679468e");n.Z=a.Z},"43bedd84":function(e,n,t){t.d(n,{p:function(){return a}});const a="Booking.com"},"3679468e":function(e,n,t){t.d(n,{Z:function(){return u}});var a=t("3d054e81"),i=t("ead71eb0"),r=t.n(i);var c=function(){return i.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 121 32"},i.createElement("g",{fill:"none"},i.createElement("path",{fill:"#fff",d:"m115.546514 25.2308571c0 .6226286-.299657 1.1181715-.905828 1.4864-.602743.3650286-1.398857.5492572-2.381257.5492572-1.1824 0-2.194743-.2813714-3.037486-.8470857-.842514-.5659429-1.432-1.2857143-1.771886-2.1629715-.1664-.4219428-.462857-.5357714-.885714-.3380571l-3.204114 1.4395429c-.4496.2009142-.576.5090285-.379658.9341714.646172 1.5837714 1.765258 2.8893714 3.353829 3.9206857 1.5888 1.0310857 3.603657 1.5467429 6.051657 1.5467429

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3035)
Category:	downloaded
Size (bytes):	199054
Entropy (8bit):	5.532208402828932
Encrypted:	false
SSDEEP:	3072:20OStJ7+C8WvT4ptglw1yttkMKROLktV9eQdYbKgB+piupyXHWw/:vR+vWvMpPIte6ktV9eUCKgB+piuoXB
MD5:	054DBD3244786551BE3B8B7B070AC704
SHA1:	1792FB02554F39C7F356F6348A25C5FB4797257C
SHA-256:	30E10EDCD5FD61E015FEA9A8D42B40ABB9DE5133A6CB152533D09186B1491DF0
SHA-512:	A16DDA859EA6950C2E7D257C2A87BE2D2277F054B53E594EB731AEF2380FCB66FFC97BB5B720B0DB426350B364A88DB4F5C1FEDFDF0F8FF3AFE8FDCFCADD4D44
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-A12345&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__gct","once_per_event":true,"vtp_trackingId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. .].,"entities":{."__cid":{"4":true,"3":true}...}.,"permissions":{."__cid":{"read_container_data":{}}...}....,"security_groups":{."google":[."__cid"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca=function(a){return a.raw=a},da=function(a,b){a.raw=b;return a},ea=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:ba(a)};throw Error(String(

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://join.booking.com/js_tracking?ref_action=index&ver=2&stype=24&lang=en-us&pid=7a96a3baef7600d5&ete=&etg=&etcg=&ets=UETTJbZWMZfPAJNLJPGEbfWEBOWe\|5&etgwv=
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10609)
Category:	downloaded
Size (bytes):	10721
Entropy (8bit):	6.147379849563543
Encrypted:	false
SSDEEP:	192:SQh8Cv7u4lugnDPTpOKkyvEYL7FuZ/PwQKSyjCjBGhILKMScqndZf3L:l7bluiwnyv3oXc25XScqXfL
MD5:	449F8ABD0585D68506A1E46AD4A8BBAD
SHA1:	D49E42C22BAA66DD9E51F38E8B1C348D782A9580
SHA-256:	C8D614605EE23556F294DB3FF2B379E8D25654661BFF372E6CAAF98EFC3110C9
SHA-512:	46710120F6E51A8B12D4263847155CEAC7F59E2EC0A076B331949A33C8FD26D4A687A7741B5968028045DD6B4C22B8A5A0A33F3BA9106C927F05A5003D6B3356
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c6a78acb"],{"07390ddb":function(e,t,A){A.r(t),A.d(t,{default:function(){return R}});var n,a,E=A("ead71eb0"),l=A.n(E),i=A("dee2534d"),Q=A("dc6d28ff"),B=A("d1e54a96"),C=A("c44dcb0c"),m="c779636eef",r="ff75376f23",s="f433c16992",h="ce6613f3e7",g="f742f17cff",c="c6286cd018";function I(){return I=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var A=arguments[t];for(var n in A)Object.prototype.hasOwnProperty.call(A,n)&&(e[n]=A[n])}return e},I.apply(this,arguments)}var q=e=>E.createElement("svg",I({xmlns:"http://www.w3.org/2000/svg",xmlnsXlink:"http://www.w3.org/1999/xlink",width:104,height:65,fill:"none"},e),n\|\|(n=E.createElement("path",{fill:"url(#prime_svg__a)",d:"M0 0h104v65H0z"})),a\|\|(a=E.createElement("defs",null,E.createElement("pattern",{id:"prime_svg__a",width:1,height:1,patternContentUnits:"objectBoundingBox"},E.crea

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	171176
Entropy (8bit):	5.505771310976482
Encrypted:	false
SSDEEP:	1536:2vn6J6P9q15F9DhYa4sOQmgoBgjBgu85mNN7j9:9J6QAsOQzQa
MD5:	DC8762D4C9A1A3D1025832E3B9BDD7D2
SHA1:	ACA0F935F154A1697ECCB9B49706436CD7284256
SHA-256:	585EE22780A7B93C8272B578EB4C64E8DC53F4F7243A9B7D06C3F54A46FE973B
SHA-512:	67D60B5D9400FD706CF431B7DCBF81F62BAA416988882489B0603FE748E542E96067A03216B106D00A637B2113674ADDF2374711AB2E681695FFC10D3C8E4642
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/21928fd5.17ce1306.chunk.js
Preview:	/! For license information please see 21928fd5.17ce1306.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["21928fd5"],{bca1141e:function(e,n,i){"use strict";var t=i("72bf8c83");n.Z=t.Z},e908bbd3:function(e,n,i){"use strict";i.d(n,{Z:function(){return U}});var t=i("3d054e81"),a=i("dee2534d"),d=i("ead71eb0"),r=i.n(d),l="a529739de5",s="fe04f404b8",o="f538ae62ac",c="a244555425",m="a6271fb6c2",u="edb4db1de8",k="e98333fe6c",v="bc476201ed",g=i("c91f1a4c"),N=i("975f4b85"),S=i("6356c4a8"),p=i("6229d898"),C="e714215256",F="cb32f1ced0";var I=e=>{let{title:n,subtitle:i,variant:t="strong_1",titleLines:d=2,className:l}=e;const s=r().createElement(a.Text,{variant:"small_1"},i);return r().createElement(a.Title,{className:l,titleClassName:2===d?C:F,subtitleClassName:C,variant:t,title:n,subtitle:s})},E={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360606642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=50931350.1705360608&sst.gcd=11l1l1l1l5&sst.tft=1705360606642&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8521&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2539), with no line terminators
Category:	downloaded
Size (bytes):	2539
Entropy (8bit):	5.966107802320046
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08x2/AeSVH/KMtltzYiglefM:wsbSUtJfxrqLWWWdV6j1QA9HyMdnE
MD5:	20AB754E776836FB2C9B8BE8AC7AA235
SHA1:	212F8311EDD438E2A514BD647B8632D8E29C671E
SHA-256:	8ECF1AF36C770F000BACB039340EBA2D0A765F2CBA473F709632F17D6C33D78E
SHA-512:	9011A51E3F2CEE45F264F6058C98A52C52E9A6CC600452B1473AF9285EDA609B2070DF2D0C73A71FF80914BA3897B167AA05DA6CBB4D2CEEDD5F441B5D8BD24A
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360607937&cv=11&fst=1705360607937&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	196066
Entropy (8bit):	5.543899388378852
Encrypted:	false
SSDEEP:	3072:54vy5CnOyr6xa476fDXn/iBrqRgBiIq637ufHfJG9ryXLZhm1kq/r:+VnOy+xa476frnqBrkg8I937ufHfJG9J
MD5:	D530485578792BE9CABC686538EA28AA
SHA1:	D2B6B1FF70BEF13D8031D5BC92DB7DC6ED8CDA7E
SHA-256:	C8B068BBDA885FFEAF81908528634F71CAE37D6BE81150F61BBF7961EF3EC616
SHA-512:	65E3708BB35881CD99492B9F24E3FACB62EAE400879B580CF901E8AABAE3F5527440FDC25AAE2F9C515769CFE5D5E0161EF420BD6CDCCFB6BC80875F44AC501F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchresults_cloudfront_sd/900b3ff8dac9efe90aa71448ed3ad5600b5ab5b1.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchresults={loaded:!0,run:!1}),B.define("component/dismissible-item/block",function(e,t,i){_i_("cb9:1d6e38f0");var n=e("component"),_=e("dismiss-item"),r=e("read-data-options");i.exports=n.extend({init:function(){_i_("cb9:60262eac"),this.options=r(this.$el,{itemId:{name:"item-id",type:String,required:!0}}),this._bindEvents(),_r_()},_bindEvents:function(){_i_("cb9:bc2d0b27"),this.$el.on("click",".js-close",function(){_i_("cb9:5fb0e455"),this._dismissItem(),this.hide(),_r_()}.bind(this)),_r_()},_dismissItem:function(){return _i_("cb9:40f33ccd"),_r_(_(this.options.itemId))},hide:function(){_i_("cb9:9a2d9335"),this.$el.hide(),_r_()}}),_r_()}),booking.browserStorageHandler=function(l,e,d,u){_i_("cb9:a11e61ce");var f=!1;try{(f=!(!l.localStorage\|\|!l.sessionStorage))&&l.localStorage.setItem("btest","1")}catch(e){f=!1}var n={_readCookie:function(e){_i_("cb9:51

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (904), with no line terminators
Category:	downloaded
Size (bytes):	904
Entropy (8bit):	5.7840564666202825
Encrypted:	false
SSDEEP:	24:hMiRO9QrdDepOhg8G9xP44/ITKMyQZYCBealj:NOaBDHG9i/KMt2alj
MD5:	58EA54E8A8D4C1702284FE8B32FB8ECB
SHA1:	586C6ED462133AFC30215FDC93A88675B376C51B
SHA-256:	F88CE47998168C4FE220E0096AD1D94335661AA23347C5554C8C5939E4F75421
SHA-512:	2D9C692546042B44866B52E2D3102DF403E9A334A46C65490247A9987D41236EDD992A3CC5349373D3C178712FBED9C979F64BD4A891D353ABC4860CA56D926E
Malicious:	false
Reputation:	low
URL:	https://11963210.fls.doubleclick.net/activityi;dc_pre=CICOv7fD4IMDFZMKTwgd1vwIQA;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=460620828.1705360583;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar?
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"><img src="https://adservice.google.com/ddm/fls/z/dc_pre=CICOv7fD4IMDFZMKTwgd1vwIQA;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=*;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar"/></body></html>

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8173
Entropy (8bit):	7.9436165824193905
Encrypted:	false
SSDEEP:	192:mIk7UsvEuKAktdWdNsW7p1uXbO0JwyPYquqw2K28GrVQ8:nMUuqtdCj11IFPux21NQ8
MD5:	24E4F40FD3D31594B7F7294ABE7B8767
SHA1:	10FF701C77FAAED59B43B446B399D6B1D8534A6A
SHA-256:	95A4B71591982BCDA9FE0848498E3A4E754A4EE3630693145A3AF210BD4A2736
SHA-512:	A67FFB6E0FC075DDD0AF5C656D568E8A0558CE725EE9ED5F1A569AC41E8E19C196FB34129C5885DF966EF8D0C76DBC21D411AC4BFDCAE7A823DF816D32CB5FA6
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H...H....V.}H.?..[..3...r...$.....i...u<.c....\..n#..'hd<..$....rT..+E5.m.K...Rd.....>......T..L....8`9#..zVD...p.....?..O.Ib..7....cH.j..d.r..j..n..Hz....j..f..w..s.............]Q...I.Cx.p_j..C[#I<.)...3.8.j{?.,.i....d...j....z......[.P..j-$....=A\..$I.2..I.8,.dg.[.W.wn%.L.0MT...^...*E.U.<..9.....&.gA2..T..CL.........C(,...V\|....Y..z....,....S.9.XjQ.

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	downloaded
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18585)
Category:	downloaded
Size (bytes):	18701
Entropy (8bit):	5.4184284886881695
Encrypted:	false
SSDEEP:	384:dj2amjHtmTs05BhX/1rneEzZ0TaFQ1e3iBxHp:8LjHoZV1ewZIl1e3i/J
MD5:	AFA1621CFCEDE0D031F983B416D2EAA5
SHA1:	32428671BE985D92F8C0D559D89B2F09BCD9C4EF
SHA-256:	1483E425B881AC8EB2F5E03887AD9AD3C4117742DE2E5841A20418F1EE7D9AE5
SHA-512:	759F2274129E628F7AABEB9938F508529921E6BEB26C65524EBA40E62D4164F6AB7275A297FA91B4CCED12253040BDFEFF72F955B29159CA01A696420C5458A4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.9e2adf90.client.js
Preview:	var bGeniusVipWebComponentService;!function(){"use strict";var e={ce7603eb:function(e,n,t){var r={"./GeniusVipMlpOnboardingSheet":function(){return t.e("8d7d1278").then((function(){return function(){return t("7ce44747")}}))},"./SampleComponent":function(){return t.e("f1ed78e2").then((function(){return function(){return t("82f0c599")}}))}},o=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},c=function(e,n){if(t.S){var r="default",o=t.S[r];if(o&&o!==e)throw new Error("Container initialization failed as it has already been initialized with a different share scope");return t.S[r]=e,t.I(r,n)}};t.d(n,{get:function(){return o},init:function(){return c}})}},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var c=n[r]={exports:{}};return e[r].call(c.exports,c,c.exports,t),c.exports}t.m=e,t.c=n,Object.defineProperty(t,"miniCssF",{set:function(){},get:function(){return function

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2324), with no line terminators
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	5.884924079792564
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt089L4SRohtzYiglA6:wsbSUtJfxrqLWWWdV6j1hLK0
MD5:	D91CA087DEF7B5F96D2F6A67355952B1
SHA1:	CF801B9FF7ABABC343F075E7D1DFB748094B0092
SHA-256:	D57F67A64DC4EFB15E0B79F1789832F7AF8763D0CDADBCA44D2F287B75A87A44
SHA-512:	78DA99B65D965A6A42DC5209C3217E3EA86C88F6AD518D1394823ECD887FAA4D9F3953515E3531D162199E12A23BC9688FB05BF0C537C4E725DF497F36106F8A
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360584157&cv=11&fst=1705360584157&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	574480
Entropy (8bit):	5.126437611490055
Encrypted:	false
SSDEEP:	6144:zZvtxBq/fWEJK6e7ZbD/GYnDX36LTfKI0Wco:zZvtkU36LuI0Wco
MD5:	B705F5FFEC0A77A26E33AC5E78DBC254
SHA1:	6EF32322F18E63D3E75241B6813433EF72FA6B08
SHA-256:	B57A0E915CA270164871F6E7205C0FEE2B0F6E40AD469EA5DF09A281E83163AE
SHA-512:	683168F3253A9724C795B7CA3450C64C95FD49A20E81DC63AA55BD2A90B401FF61291C22C35B1CAADA61AC36F0A1454A1F82AB178CD79C0A4494855EEC249B88
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css
Preview:	:root,[data-bui-theme="traveller-light"]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_color_foreground:#1a1a1a;--bui_color_foreground_alt:#474747;--bui_color_foreground_inverted:#f5f5f5;--bui_color_brand_primary_foreground:#003b95;--bui_color_accent_foreground:#946800;--bui_color_action_foreground:#006ce4;--bui_color_callout_foreground:#923e01;--bui_color_foreground_disabled:#a2a2a2;--bui_color_destructive_foreground:#d4111e;--bui_color_constructive_foreground:#008234;--bui_color_foreground_disabled_alt:#d9d9d9;--bui_color_action_foreground_inverted:#57a6f4;--bui_color_action_focus:rgba(0,108,228,0.24);--bui_color_highlighted_alt:rgba(26,26,26,0.06);--bui_color_action_highlighted_alt:rgba(0,108,228,0.06);--bui_color_destructive_highlighted_alt:rgba(212,17,30,0.06);--bui_color_highlighted:#cecece;--bui_color_destructive_f

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360607982&cv=11&fst=1705360607982&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.844555459508597
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKHNqFjKW6s1d2/4VgWaee:PLKdXNQKHNwjgE84VgL
MD5:	74A981E3AAAA1F7200E5F87B03883703
SHA1:	22CF9554C2D813A219B2982AE769695119AC1092
SHA-256:	55052D853A3F144505DC773EF237AC838AF312C0180FF293F7CF1A3847345EAB
SHA-512:	0E3190F7E3DE1B0127001342B33BCD3F23AD1BF113FEA94A97F9D4A59C9C6BFEEC61A5889BB69FB0D16BDED2656529DFFD69E48D4A4B32E436346772D7D8FBF2
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js');

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	downloaded
Size (bytes):	58584
Entropy (8bit):	7.968304303880018
Encrypted:	false
SSDEEP:	1536:9N7O8cFGyxtSD+wrnTBayfsbenlWTNGjT7bf:3U/k+ATBawURGPf
MD5:	BC97CF66E6D1C4C3C688125085F0B084
SHA1:	4A3895EB2878D0BF2D236B65B6737FFBB375CDCA
SHA-256:	E3BFE1C17CFFBCC8EA82E6CE2F1C1E4ECD92093AB986DF64208B4C35201C4289
SHA-512:	9D0C62048863219698311F6A7A581AB0EFD89A5D42E2DD4BE67B7797DE19F45BAD549DD391FF3E81EB83269129E91CC664490A7101EE3B6D0D917A8A27C8A9EE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/600x600/976884.jpg?k=00a3546794e9e8cbb86b98371056949ee731002b76358467601e85a0b09dd6db&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........E.P.R.1@..8.P.E.P.E/jLP.b..(.QF)q@..R..IE.(.(.....R..J)...LQ.\qF(.(..-+..R...Qq....=E?h.ld8....6{.p..)@.&._.....JpZp\R..h.)h.!.&.{Q.zQ..4\4.,SL'.?"..R........V./\|Q...f.+g.PjS..MD.;..d......U2.8...I..L...;`..BV....R..RE.....Gj.....s..tN*Q...S.>.....,.!....x.2)L..0.})....A.N1..~g.&..N.... .......f-.`.. ..)cM.R..T.q.Rf.y.Zb.Oji..QT+.........7i..I..Ni....

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3070)
Category:	downloaded
Size (bytes):	3186
Entropy (8bit):	5.185231249127626
Encrypted:	false
SSDEEP:	48:G4aCJvTLa7tbAekC/fnPWatweFNUY//Qegl9Fy8q7Sqr:LlvTL+tbAekQnPW2Jv2U8mSe
MD5:	C4AA6CC0B7D7B70CD0B7409F2336E955
SHA1:	1E1BAC9FB81A0D905E2FA6116ACFA944CA06B78C
SHA-256:	A9F487E0A73997C7805867506804220858DC2A13F53AE2D02E6DE4644364B6D7
SHA-512:	0B6A0D544C4CEF1D6C38FCAB9719C94B6AB72D20010EF15A21AC825C7314621FF8B290682BC952246D8478C6CF39AF8F133502F46C7C79FAC785231F02622EC2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/21928fd5.c540d700.chunk.css
Preview:	.c0408c1843{display:flex;flex-direction:column;height:100%;border-radius:var(--bui_border_radius_200);overflow:hidden;mask-image:none;-webkit-mask-image:-webkit-radial-gradient(#fff,#000)}.c0408c1843 .f87772bb74{opacity:0;transition:opacity .15s ease-out}.c0408c1843:hover .f87772bb74{opacity:1}.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1031205
Entropy (8bit):	5.380277193815763
Encrypted:	false
SSDEEP:	12288:L+sKKtYar9q6qdWjFBqN9aVkYblD8fBms:L+sd1r06oWE9aVkYblDmD
MD5:	92FECD2D77CC2E49867C2F067C4F3B23
SHA1:	211B979591995C934E91AEC7E5664DF8F687B53B
SHA-256:	51C85F87A98EA9BAA27BDA927DD7A51951CCC1C1B74843067E716B98FCB811D5
SHA-512:	3CD42FF1CED587CDBDD7766B9B2962ABD776CCFB52308995C2D0946C7065800488E86C42D5B3B0BBC364761D956A5DCE49D11A6420781C367449124357B76899
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/client.16f4dc63.js
Preview:	/! For license information please see client.16f4dc63.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2081)
Category:	dropped
Size (bytes):	125161
Entropy (8bit):	5.125059919374461
Encrypted:	false
SSDEEP:	1536:AF9Q1Q/UEwtNGb4N4EXQdQUJ6v3Q7F+L0TVGsAU08NK5u1w+OKaS6PYIlbErBQnK:A9UEW27OZvPZqJnWjU
MD5:	F4BDFACAB974DE01CFF5748FFCAB22D1
SHA1:	EBAC180856D066E7B7D7D44AFEA5B7B8AF27915D
SHA-256:	9B8F4D2124FD7FFF5A976DB49A94543645561143B3776D4E9042D7E590210A8F
SHA-512:	AE8332FDE28F2B2503CE9EB26333CF4A8EC5341617DD5BA38963618CAE4C2BE9CB60EB88B824C18D6B5E52A9B12F52F6D9B8C3A45D962CFB0B348F612308E666
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html class="glue-flexbox" lang="en">. <head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <meta content="initial-scale=1, minimum-scale=1, width=device-width" name="viewport">. <title>Enterprise Advertising & Analytics Solutions - Google Marketing Platform</title>. <meta name="description" content="Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales." />. <link rel="canonical" href="https://marketingplatform.google.com/about/enterprise/"/>... <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	dropped
Size (bytes):	90590
Entropy (8bit):	7.97624342479417
Encrypted:	false
SSDEEP:	1536:9yVo+GWbDBLXnCpPP6LV5sq8TGUGy+ZKJExqVW+xPOKd5Mmh2w/UQ4sJx:YoObDxEiRbyCKJHVTWQ5Mmh2GUQ4sJx
MD5:	FBF7CBF73E0D3B7F0D6E22E5188CECE4
SHA1:	013992D9AC52A63AD2D12EF1CFC4E7E51141D8C7
SHA-256:	72E6952E34BA629CA3520C329A6BDEC09619E5A4457D3B89BDAF95A4CAA18809
SHA-512:	F5F2033F5C4DD8085B80292429BF9EEE7CBA38AB27E0F256EEEFD8593351B8DF7BC6D08E4E0307F559847029FECF53A06269236085B0181D9A73C4AEB977D044
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[.2.....I,Mh\....Yl...ry.........of#..K2o.q...{....T.......q.q.....<....\.H.V.xKg.}s.~...K.{..i.k$3&C)9....y.k8#.Kxc\.}....v.....7.a.....Ue.'...a......<...I9.c94..>2..4..m^...e.xP..w.O...>....\|...g.!.OG..7.........u..Y.y...G..r#.0I...H.k..&.A.[v...0.`...r3..U8..;.JM.3..4......T.ly........c..v.9...x...ke..$...Hb.NT.....<z.Z.c.B..KK..W..:.'?(. .s..\.v.jZ.S..

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5364
Entropy (8bit):	7.906665501686905
Encrypted:	false
SSDEEP:	96:ghIEhDH7a2DwHfLef7khjhS69A5zUGsw58RcmUSvE3WaLZwn:mIcDHWvjeEj45zxsivV3DLZw
MD5:	06BE00ECAED1E83D7B95EF8E24BDF64F
SHA1:	C07FDDDE0568E47193737A9CCF93E1338477D52E
SHA-256:	DB3E2202C7980ADD6476E2126A65D4460FB4ED5CD92D59DB603D4120EBDAEE9E
SHA-512:	392DEA2CEB22FCEE7D2448017DDD4B0E404C30B44EAD739EE388BEC4FE85D4AA520DAA7126D09E9F24130CA9384CF9DA5B27D15462D00B4660221A4BCB548AE1
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."... ..q...`o...t..O............z..i..Fcu.....CU..x....r........Ty...@..* ..\c.W...}4.u...Rb..Jb..B)...q.".......x..I.n(..Rb..1@Xf)1O.&)..b...(..9..FKyUm..@..#`......{V...mv.S..G.d#..=+....:.......%.}B....]c.8...R.)....~n...b.RL.....bI..>ea.H.......\ Y.v..q\]..*J.$..+.......Z....]J5`M..?!q...j....~.n...t.w.N.).F}...2.......K...l....z.Q\...qW....:.m..4RC..?.G

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	677
Entropy (8bit):	7.575211646320257
Encrypted:	false
SSDEEP:	12:6v/7HAMhHnOUO6n+M1VKTVc8OPGCg7QIrnHFyzdrVFNVHI6w2c:ahHOT6zfKTAxg75HFILH6F
MD5:	985D500E868764DCE857B43C97BDA06B
SHA1:	E63F372410FFA0F0F7B3F82C76A6EDDE04B66228
SHA-256:	616FE7542FA3440682C18C0B2377EEBC82848CD7A0976DDECCB4ECD228131AC2
SHA-512:	EB6E7682C957CDAC09EED159C9927C2C14EE89E44B8BE634AF67907A7869A1D49559305A663DD47AE8BEF8A49EB458718EEA71C6F782954291473D51060F8152
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48/us.png
Preview:	.PNG........IHDR...H...0......B.....~PLTE..0....x...5E.......0...<:p.s}....HFyTS.dOz.;J.;Imk.a_....yw...............'A..........mk.......`_.....d{..........@V5.e.....tRNS.......v.......IDATH...r.0.D.%.h.H.u.h.f.....h.l.}.U.....&. .....T'Fl..@...wg[kDq".I..g..r.0...E.....q}.s^.....}..kdDKb.0:aHV}...M]..cT.I..$...........3H$$...VkD1.>...."l.1..C...g#..u....?...UvMD.....O.72.DJ...~.w;.4\.s..9.L.......\.y../.hk.....0..a....0...@z9.y.......[9.......a.....c.UV..O.anCd.(.2../J3..pP..v......AiX..DD.3c=.sB.F..I.G...X#;.Q..WLlY.+...r&L<+g.e.wL2..7u..}.8..Ku....U..&c^..F.:.o...cS.].FW.4zl......=...............VF.2:`.[.=..d...$~.....IEND.B`.

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 72, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	950
Entropy (8bit):	7.69670577809709
Encrypted:	false
SSDEEP:	24:ahvlk2c/6qz+2SDaUGyHHT+hYuwNdfCIaKFIxp8c1wolBTaGIx:Uvm2c/6gSDbHCWNdqIaKFIAc1D2fx
MD5:	025B409525836B9E0913038B2556D2CF
SHA1:	187B28FAD3A710B3712B56E53BE8FC4E142D9ABC
SHA-256:	BF146C2FCD8C33FDEA4570ACC5F92BC73B337B1EFBBB2C318089F7BEA5396672
SHA-512:	5B7A5EF3A3A941A92D33FF9713AAFEEBB0CD21E3E84332DDEE259562D33AEFDB36644A99F316A3627AFEC1ED9E51D1B0E3E47B846DE487A393EC768A63C150CE
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/images-flags/Us@3x.png
Preview:	.PNG........IHDR...H...H.....b3Cu...TPLTE./].w\|.hm>Pw...!7c....=D.QXVIi+?iix....Yh.J\.5Hpz...............21Y.}...bg.....^u....pHYs.................IDATx..V.r. ......>7....).........}.Z............[.......B.G.@$z"......JH7..{...&..G....LVu~N.U."S.~K.F..B./..mYP.%..&`...B..:.It..]..4.....L...oIb.-U.B..c]Vu..Y.iy(.g.7...L.j...RC.!6...-..+..........D.3r./VB.7?'#}5s2..n..0Q.T?./....B2..nFr.........g,..."G..HlFm.....&..&.......{M`>.L..6=hn.O..p..h..:W...B...M.D.u.X....B.,e-Y...7..={..i...SwL.&..:..1......Xpidl..3.r.R....l.".FQ.^.t%.....q.eQ.sRv."..........5....a.....{.Z.....fX.-.35.{.p..c+.).F(P.9PN..!...Y..x....<Y.=.....{..1...r3*..#........Q..83.r-XM...6.f.6C+:.d....9.9.?.._...D.3.#....).F..... F..f.@...N..:O.....h}.0c.q/..'.Bh.b.B.%...p...#.r-....#.D<.Go.1..g.y$..f.N..r.3.......j....9.#yt...k..4..$hA9..Z..H...i....B??._{.....:.\|..p......_.P...B...........=_.P...B............x.....r=.!e....IEND.B`.

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.5934148248551665
Encrypted:	false
SSDEEP:	3:UW2ChW/BYwQPS1Rc/SaJqOMLDHk8f:P2dBTUMqJqOM3Hk8f
MD5:	335BE8900580E9C3875DBA57334294AE
SHA1:	A86597D2DDFA410DF13BCECA86FDF9A2291FE798
SHA-256:	8A882FD19A15567E53A5C3C08D22CDAB714FA87734ED92D854C4E8FDF3940B1F
SHA-512:	1D51C3CE06DF5B1B6D305691F1BED48E5EC155313DFA899A98AE94CC625E39429EC81A4D82378FCA04FC9F1F694913A61AB1B0E0F31FCAD5CE9B29A0AA0EBBE5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js
Preview:	window.b_crossorigin_support=1,"function"==typeof window.b_cors_check&&window.b_cors_check(!0);

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7359), with no line terminators
Category:	downloaded
Size (bytes):	7359
Entropy (8bit):	5.295231759326163
Encrypted:	false
SSDEEP:	192:jGCtmh4WeQ0w3whWfcS0XnR8o8dQVw0WAogNCDWYSNkccHSodZe4u0vbEqKl:jdtmh4WerzXR58dQVw05oUCyYSec47dY
MD5:	589B18CC52610713B96909E7E6D49592
SHA1:	58A865E81DBA2223DE8AACF3014F3F113509CA3E
SHA-256:	91BE406D17E5F972F0141BB85E483CE24F9DD04793F436198904CEEC362CFDF0
SHA-512:	7904BBF42B072AD0131633A9E030972765108A5C8CAB73B09FD9A0B3C586B0CC0007D2FB83CE50FFC30B5EC20D028C193E7F423BED7BBA5549DAA110BD6027D0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/help_cloudfront_sd/1cc79a777d0ed9b6630492bb27146f0ce4e90d25.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};!function(e,r){_i_("974:cb6a547a"),e("ga-tracker-base",function(e,r){_i_("974:7c495c2c"),r.trackTiming=function(e,r,i,n){if(_i_("974:4f31b963"),!window.ga)return _r_();if(void 0===e)return _r_();if(!r\|\|"string"!=typeof r)return _r_();if("string"==typeof i&&i&&(i=+i),isNaN(i)\|\|!isFinite(i))return _r_();if((!n\|\|"string"!=typeof n)&&void 0!==n)return _r_();window.ga("send",{hitType:"timing",timingCategory:e,timingVar:r,timingValue:i,timingLabel:n}),_r_()},r.trackEvent=function(e,r,i,n,t){_i_("974:10645770"),void 0===t&&(t=1),void 0!==e&&("undefined"!=typeof _gaq&&_gaq.push(["_trackEvent",e,r,i,n,!0]),window.ga&&window.ga("send",{hitType:"event",eventCategory:e,eventAction:r,eventLabel:i,eventValue:n,nonInteraction:t})),_r_()},r.trackPageview=function(e,r){_i_("974:0b8e2536"),void 0!==r&&("undefined"!=typeof _gaq&&_gaq.push(["_trackPageview",r]),window.ga&&window.ga("send","pageview",r)),_r_()},r.ecommerceAddPromo=function(

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 100, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.6459447725206005
Encrypted:	false
SSDEEP:	3:yionv//thPlEbttZoGjxd35+kx/bp:6v/lhPG0GjL1pp
MD5:	FF823944BC0BB9E4BF87F0AD14F687D1
SHA1:	4B68BA281B9AB171611569BF78971DF6970EFBC1
SHA-256:	6153929734EC12EC07072F327C1112301828497E4DD356CA261461B0B7BA9621
SHA-512:	1338ED16F60A4C9BCFE69AF5713F86D231995637D83D9628368DDC97CBE034A95645B5FBD29DA886738D70656485D37CA0042AA2D03657DB96007114C0AD2D3D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......d......N.7....IDATx.c`0..<x.....FQ8.P.....IEND.B`.

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	711
Entropy (8bit):	5.234972346269204
Encrypted:	false
SSDEEP:	12:YNNGa0+Czxyb715N7EmLz2Sdknz/iVjAWVoja1c:YNNGa1CUl5N7NLhdknz/iVDS1
MD5:	14953EEFD6BDD3416F064DBA2C9E5630
SHA1:	7B7F7DB6D1D9181EAC7572B8986DE7660FAE58E5
SHA-256:	3E3E77C66876714F26F002AD8C4E8E814EFE74FC4A99ABB7806D2E358786091B
SHA-512:	E2E2DCD48BB029E3BBBD8E9C2B5FFD53849DF480926492250B75B3303B8D922FABA3916C95880CEB17E1D1157F16DD023F2F028DC36981D870EE5BBA863B0A7A
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1309977198800880&correlator=373666712671362&eid=31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D13b0a081-088a-4209-9757-61298c44974b%26affiliate_id%3D304142%26rendered_ad_pageview_id%3Dd7cca39c07340212%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie_enabled=1&abxe=1&dt=1705360582423&lmt=1705360582&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360582&ga_hid=273011141&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360568635&idt=8822&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1172277823&frm=20
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,[["ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ",1739056584,"/","booking.com",1],["UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA",1739056584,"/","booking.com",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CIXd7p7D4IMDFSjLKAUd0ecIwg",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qOnUkJY8wNYpxMc_ADgOVkM0xygFQLZukegzu5nhHEM-Nu-Tnrixv8XFDmUv9uzyqP2V4To0exyCg"]}..

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1606 x 765, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	210892
Entropy (8bit):	7.962502599388432
Encrypted:	false
SSDEEP:	6144:SgmNfvaEICxTKCqMXKGY2ayHLkYEUc3ydOOfr:SJBvfACqMqlwnNaq
MD5:	DE106B424D9C3E736045CF5E397011E7
SHA1:	730776156E4FB71E40D2E334FA1764233CD6D5EB
SHA-256:	4106B2D21AB42C4365272BDEE58A096FB6E6EDA00A15EF9C8B5BFB593C5E3595
SHA-512:	DADCE234F2F89C3D8B9F44E14FE9CBC410567E621026249FA55998793E230388FC6D2C173B58997076C7F39BEE120C9A355A92690837ED6F4DD3B8C7DC0678F5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...F.........~..X....sRGB.......@.IDATx..[.,.y..8.....v...X;B.3B".w\|..#..H.$.].J.[X2W...W..)H..p..02..S..{.L......k..{.8.3...4S.U........5.F....#`....0.K#0.......d.....a........~+.....[..~....o......8W.....^.....>..#`....0.F....#`....0..E....\..0.F....#`.6...I.....x..7[7o....l....;.N..........>y....B.......www.\|.\|e.B...^qxxX.....;w......?....7..>. .D.R..d.J..L.v.I........0.F....#`....0.F..l....l.+u....0.F.....@]B...%F.e.@....^{.%.FC.........+..%....o..o..{.p.....B.\..Yp.....o.eM......7...pN.../..... .-.P.!...%.).c..`....8.V..w.....#`....0.F....#`.... p.....=1.F.....F`\|..g.?...i6..W...>........nH..%....w.......A.b]..\B.\_..oGB..V.:...........!..~....Z.k}d.....4.A....NV.q.0..!k..P.l.6@...0.F....#`....0.F..l....B[.1w....#`.6..4.i.......1.M.(K..........i..'?....Q.3.<S..?.C0.s.R.......K8....o.\L5$.h....k..eGv]..V!.5..a...X..g..h ...vd.W.AH.<..,.....T.{...WZ..InO.xL.r..........:.$.\|)..=...........W.wW..@x.y(..0.F....#`....0.F...

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://booking.com/track_join_app_landing?progress_status=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	47044
Entropy (8bit):	7.996449359306395
Encrypted:	true
SSDEEP:	768:ezupOXz1dh2H4FaKt7EWvDAlro8OB+YhPblsoQeSAlff4KdFadZMIF/pztWvcW1+:oucu4JtIWmOBnhxsrulX4Kd0XH/VUvB4
MD5:	C41BD4232794517257342F91A8D7EFDA
SHA1:	91FFB521249382DB3765C12E16638B8789D3AD11
SHA-256:	631797E5D47F343739554BA3436A51D381F520C1D53C65783FD51D68D5904702
SHA-512:	4790DD51B0CCA1A08021DE90E4AE955EEFA976A59F0C1F998A92794B84D5C96487AE8DC928753287AC27404BEBE39CEFA29563C8DCBBE9F6B6EAE518CBA623C0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e0b261f88de846c23d3bf5693de202238&o=
Preview:	RIFF....WEBPVP8 .....y...*....>m..F.#....=....cl..+..!.5....+.Hx^.i..JF..>.{..?..`.#......y.(.`...7.>?..........d........\|............;.W............?.}.2.......'....I....m}......?.^..q..o`...I.....^....\........._.m~..d.8.....q.e..e]DI.}...D.....bw.pq..gM6...).2Q.3kh.>.&<."g..F`.D..&..hW=..XB..p.O.A....G.{.g...f..6.I.W..O...x.~..Pp.\|.p..c..f..O.b...%U.}.;op..H..y.?..i..U.w.3y..THL-.....XX..G...`.....kN..M.M.9.(G..iV0...(\|8...c..)..,..`....kkh"...<...L;.+)W.}V.......s...<3....X..J........I...R....p.t....]........>..V.....Z....kq..-....^...a.(-r........5q;.xvE'$6.9..N.....}B.../.....g........v."_'..?....\|6.+..O,U...O...x.......(..q.}.d(.C.l...j......c...~.@....&....'\|Kjx.....m.3..8....O.'g...7t.Z....}.....5.5).s....2.n.d.._....\|.%3..P...;.....e....0....g.......,...W.3..8......_q?...E^.$.=..!.\^\..^$2.2R<....-...J...z....T.R...F.D..!.5.]....B...&s..."~...v.'1..W..6....v.......NEo....~.....W..]\].2.. =..!1\..4@.W.....v.:..e.]>...Ko..rG4@

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1878
Entropy (8bit):	7.7719881409378715
Encrypted:	false
SSDEEP:	48:HTD+qk2/6k9aPZbvzIT5nJOgZOZvXa3elULkw4t7:HTDtk2SKQq5nqZi54t7
MD5:	05C42F2F2CC422FEB81862208C26899F
SHA1:	0D7952B00E0716A3F0649D49BA8A4DD17403DE9C
SHA-256:	3E95390F09D7FE928C6784D3C89CFBD030241188CE2D9E9F9D658ADAD337B47C
SHA-512:	A452EE142FE9EE289446BA363D6F401887C728D26AB1304324170D5ABCE0066EE3570963686E0CC218D93741D6969EB46ECDF6DD5610B13F59D8D8943377B6DF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x.............PLTELiq..............X...........X[?@.....W..W..X..Y..W........W..W..X.....................................X............................t.3k..9..W.."........l.....9Q.....H\|...Oe.Rm.....'.....tRNS.ct.1....E.B.Z..y...+..]...1..M......pHYs.................IDATx...r.:......vpK9.............D13w&.....7k...B.....XF....Ikv...W\`.(.I....._v.......2_...k......v.n0...h...i..'.. ...P.a..._lT..M..YB0.-]5...T.z.b.e...4[z..[..F.M.F..m...n..}Z.~.....f.J..#......Y...O..8&.P...Y$...2a@U.q.`..".g..m..{:.XSfm..4R....k......V}...x...3.......g.C^.%..x..i.~.t....W..x.t`b...5.l:^d.K....3..Xd....]..........py+.224.\|O.#.j..^j..]..T`.qN.l.."..E....#22.4.WT..=3....43^..}u9..x..xaBs......h..K..>. ..Y(f./.........p.!.6,Pn.Y.^.....Lf..$aV..gV..U....f.x......Yj..f.x}v..\|.E...)......`.3.%....Y.^.g.Y%:.l~.3....$.{4,l='9...W#b.k=._9......i6.R6.r.w.&j..X..R..Y:....n.]..........hx.-7_.v..^m]..)7....^...xMxv.(mWqxu./{..8t..__.U.^...'.k6..]R..

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65487)
Category:	dropped
Size (bytes):	226735
Entropy (8bit):	5.346118746193619
Encrypted:	false
SSDEEP:	3072:sosn/wOry3D0j+mTUXBwgPl/QC2NwmMxrrSeKdSF8UeZ28m4u7k5GT2/2uReiMmZ:64OrM4aWmd/QC2NwfagFAZBakfRV
MD5:	CAD5FE4C499F7568E14E7AB6FF9B3361
SHA1:	7CF66966B26C499B535EFD53C77F65DF7DA14338
SHA-256:	83F4228D1D92171186E8B8CCCE6E69B32AD6B322DB4AF7E4B6F54CE50E299587
SHA-512:	88320686F20F22AA51C2F9493EE8114A9E613C2C93B6F104FFBFDF7A096CE6A3111BA5ACA7598EE1BA1B4FE953D141C79598C5AD096FC89E81F1370D844AE886
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'booking-iconset';. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwAAAsJAAAAAgAAAAIAAAAEGdseWYAACwsAAJY7AACWOzKPBVGaGVhZAAChRgAAAA2AAAANhact9JoaGVhAAKFUAAAACQAAAAkEqwQt2htdHgAAoV0AAAIDAAACAyG4yWibG9jYQACjYAAAAgQAAAIEAJMgdxtYXhwAAKVkAAAACAAAAAgAiwDLm5hbWUAApWwAAAB5gAAAebQPj6JcG9zdAACl5gAAAAgAAAAIAADAAAAAQAAAAoAHgAsAAFsYXRuAAgABAAAAAAAAAABAAAAAWxpZ2EACAAAAAEAAAABAAQABAAAAAEACgAAAAEAOAAZAG4AhgCkBaAIzAyuD2wQShJEFCQU+hW6FeYWzhg+GIQZ2h1CHcAfZCLMJxwnYieUKJgAAQAZABAAEQASABMAFAAVABYAFwAYABkAGgAbABwAHQAeAB8AIAAhACIAIwAkACUAJgAnAgIAAQAEAbgACQAfABgAGgAeAA8AFAAfAB4AAQAEAbkADAAWABgAGgAjACQAFgAiAA8AFAAfAB4AOwB4AIgAqgDCANwA5gD6AQ4BOgFKAV4BdAGKAZ4BsgHGAegCCAIeAioCRgJUAnICjAKkArACvALMAuwDAgMOAy4DRANUA2gDdgOEA5QDogOwA8ADzgPgA/QEBAQaBDYEQgRQBGIEcAR8BIoEmASqBLgEwgTOBOoBRQAHACYAFgAiABIAGAAWAQgAEAAlABgAHQAWAB4AJAAWABUAIgAWAB

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
URL:	https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=8123738693747330429
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:HFyYn:cY
MD5:	85A457E0BC4DA26E33EB48486E14FE86
SHA1:	5825E76A08C3727D0144E119F8CA1ECCF4B9D458
SHA-256:	7C05744B024307F285EF529473A3604552DF55199210F13F3D082A664D64F935
SHA-512:	160B7545C364D4279D667893CFABB32DF5D130FF0F40086CCC477322BA66353E6EB3D13EB98B750D86046A88D0DD120DBACD002CE4EF046694559B6A54224C5E
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlFuT3KP9CZsxIFDUWnAYs=?alt=proto
Preview:	CgkKBw1FpwGLGgA=

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1705360583484&cv=11&fst=1705360583484&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6427
Entropy (8bit):	4.861223156043332
Encrypted:	false
SSDEEP:	96:FQef+XH7M70djbWejwZ1ICFBr81YO7+VlyZ2PK/ppdkvbMFIKuFsVzgoAytvPBxr:FsrMYoZdD0dcg/HavbKm89
MD5:	D6865979621492BAC92096993C559C43
SHA1:	6FE79DBD9D775D24ACA921E5B6ED9EEC4572F31E
SHA-256:	3D5DB88A81FF70F7D26E336FC8ED4188F5AE5032F97D334E4288322889096B77
SHA-512:	2C6D42383FA0C6C441BB810B0E25322ABAE62903B3E2DC2AAB563F4DA6419DB196FABE1D1229583F682180C3A144E5709E2C3EE529EF53211010B11A05D9B3D5
Malicious:	false
Reputation:	low
Preview:	{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExperimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":0,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":0},"copyTags":{"webcore_shell_footer_booking_statement":"{b_companyname} is part of Booking Holdings Inc., the world leader in online travel and related services.\n","webcore_shell_footer_copyright_statement":"Copyright . 1996.{currentYear} Booking.com.. All rights reserved.","a11y_webshell_close_currency_selector":"Close currency selector","a11y_webshell_close_language_selector":"Close language selector","a11y_webshell_header_tools_currency":"Prices in {selected_currency}","a11y_webshell_header_tools_language":"Language: {selected_lang}","traveller_header_account_currency_all":"All currencies","traveller_header_account_currency_most_often":"Suggested for

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	379
Entropy (8bit):	5.598593171533655
Encrypted:	false
SSDEEP:	6:+46p5p1J26p5p1JLr71P4dt8bAnQO+T37h4pIoauwcWzBVV:+3L5pG2mQO/IoauwcWlVV
MD5:	4B78841A6A18BD217B7C158BB38D72C7
SHA1:	8A023A64EEFD16755031138443E3E0C370FC569D
SHA-256:	C5BC43B589633D6F78E3EF0AA408E4008DA98114293A4FFF8E752C123B13D304
SHA-512:	863D314064E406A7073BECB07D8DDCD497AD0FE0D6BAA112C25BE587CC6B791C05AFB697494263DE5D417C20C8F648210A89CF909427F1589419A0C11D85DC16
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/b25f03c4.223f6b5e.chunk.js
Preview:	"use strict";(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b25f03c4"],{fe905f7b:function(e,_,b){b.r(_);var c=b("540adcd8");(0,c.serve)((()=>b.e("926bcaf3").then(b.bind(b,"64b778ad"))))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/b25f03c4.223f6b5e.chunk.js.map

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40737), with no line terminators
Category:	downloaded
Size (bytes):	40737
Entropy (8bit):	4.997491941347246
Encrypted:	false
SSDEEP:	384:M5SKTxTRb3XuBJvF9N7HGWslNuB1RgN67IG4Hfa0x0slyJoR5HZ3zyAZE9U:wxRJ67IG4HfPx0ud
MD5:	2994FC3C1F6BD5DC253375B97D2A50AB
SHA1:	72308DC1F3B2838815E3EBC52C3A260C25DA48AD
SHA-256:	20546391C40C2B2D6613F41FCC545EFC6E0EC706C43A90D30D0722070045AB36
SHA-512:	6F1FFC767701964B4C1BB6BAC5FFF414B80F32030E4B49B4D44133C3766B6685F86BAB5D67CF863F4183AFD6143C3A3EB14E9B45CF97F8FCB02AE31253E42E22
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/logged_in_cloudfront_sd.iq_ltr/8c222a285cb8482a2fbef676ad2203a1091495c0.css
Preview:	.gesprite{display:inline-block;*display:inline;background-image:url("//cf.bstatic.com/static/img/genius_icons/genius_module/genius-sprite-v3/bb4cc833ed909880932be09d56cd73a54c34956f.png")!important;background-repeat:no-repeat!important;background-size:710px 360px}.b_msie7 .gesprite{zoom:1}@media only screen and (-webkit-min-device-pixel-ratio:1.5),only screen and (min-device-pixel-ratio:1.5),only screen and (min-resolution:1.5dppx){.gesprite{background-image:url("//cf.bstatic.com/static/img/genius_icons/genius_module/genius-sprite-v3@2x/baa5889c4234592e992e2945f2785f1607a6663c.png")!important;background-size:710px 360px}}.gesprite.star-grey-small{width:68px;height:68px;background-position:-0px -0px}.gesprite.star-white-big{width:150px;height:150px;background-position:-70px -0px}.gesprite.i-booking-genius-blueyellow-12{width:84px;height:12px;background-position:-597px -252px}.gesprite.i-booking-genius-blueyellow-14{width:98px;height:14px;background-position:-597px -268px}.gesprite.i-boo

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	122058
Entropy (8bit):	5.3155706001979475
Encrypted:	false
SSDEEP:	1536:BikI20v3JBgjBgSZ++tFjBgjBgZemmNIsLhjRUY:k1v3IZbSR
MD5:	15334A0DF0F69C8C9870EC8B81E0197D
SHA1:	5031F15D04BBCC3C54DDCE82896CBA8544D74851
SHA-256:	121B8DCFD9FCB916F233819AD5511DB05F1B2C1D21366E40F904BFA85C94A8A9
SHA-512:	C8FA4B586E381DFF041C04C492ED7EA4F50F7A4D016DADEEE1CC2133C5EA8E97709F39BA439813CE04A400369C894F85D2FB89AA17D091A5C5F737D6BDE72370
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/43e47265.bbef290e.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["43e47265"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInternalUser()},get isLanding(){return e.isLanding()},get isNormalRequest(){return e.isN

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2541), with no line terminators
Category:	downloaded
Size (bytes):	2541
Entropy (8bit):	5.9650850041633205
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt0854LOSVH/KMtYohtzYiglWl:wsbSUtJfxrqLWWWdV6j1l4LNHyMtw0
MD5:	CAED8120ECC087DEE7677FF2DF0165B5
SHA1:	555E5A82226D14F57D2E1AB8692922CEAE39824A
SHA-256:	BDBB573AAAAD3EA2C6BA917E3EAD358F7B7C886263CC7312CC73F0D8D976ADBA
SHA-512:	C4A52079D8B79C695B7815B5716165F1F8A2E0DEBE572DD23CE8A1A705EE66FF7111A8D998CBB34812AE38B583343060ACFB5D0C8C5BF82E0D3EAFB444B9BAAD
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360608028&cv=11&fst=1705360608028&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x500, components 3
Category:	downloaded
Size (bytes):	45792
Entropy (8bit):	7.974352553118242
Encrypted:	false
SSDEEP:	768:FFevOGtlL7ksEysW87ScfhjFUe6maghjlsu+Ij+y2IX7Mfy17t6tiheoPB9zwQWU:FFg/tqsEysWBcPUtmaQlsuPj+VILwyR/
MD5:	0333C11DE7B88C4FD1D534D2C0BD59C4
SHA1:	C924AA1DF20B7E1EA8E642CFCACA476088B0EF9E
SHA-256:	5E9A16504FA6E4B9605B63B630CD686120A88BAAD5AB03A9F4BD788479F808B1
SHA-512:	39EBA832DCC54FB6E2629FA8F0F7D4D0CEF7D238BD7D5776141A25F1F6CD0AD2F20A76BD0C95B02EF3B0891B9099B55FDC07C20D69E5A09516B2D572C36D3253
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....K].lh7m....j.GZ..... 0,.... v.v...\......d..Y.z...p]T.T...V......u%.....:`..A$...Z......<..T. ..Z......B........;%.1..-.e.L..+4...]....X./.%\$k.s^..@..\|h...\...1...#.{t>...(...].i..bx.y...W....Z....k0.T5......._..F.t....U5.M..Gf^..>.jK....u....b..?.mx.........k.l.O.$T-.kbk...O...x.\|~g.3...d?.W.Y.<g..w.l....{..6I>.5.>#:...x..~'....\...j..G..O.m..R..[.

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	28618
Entropy (8bit):	7.993426317521322
Encrypted:	true
SSDEEP:	768:i7HOxn2ZkEzD0sMvSN2Nu54pTO/4NxYpadJke:uE2aEzMvw2Q4RO/KxYpadye
MD5:	C2F129CC95596EB8D50DD34DC095E5DE
SHA1:	2AAC01AA7330C66540917DA1B4F205251D3267F7
SHA-256:	8C8E5782453466A1B78C6391FBE45F6A5B5A74FBFC8795222833B6F9788AF4FB
SHA-512:	D0BCF395CEF092DCF452C870FE67E11F9B9AFC796CC7B2504AD3A0DFAF9C98EC16F222F4CB039410A782BFBAB4419054A7189D89ADBADB616CC7E513EC1A1D56
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b68fe5777bddce07972ac30ae28ab8b8f2&o=
Preview:	RIFF.o..WEBPVP8 .o...........>m2.G.$"..U.`...em.9#w..-.A."IP. .N{F...x..".W.u.+..k.....o.?Z.O/y....?.~..q.ou.y./.f-.=\|.\|....._.g.....C.....{`.....z....Ww......?.y.}..g..f=.?\}:...9......?.......+........{[.....JH...n4..v..H."af...emv^~..:...._...)..QM:.ki........[.8~ZQ...&.t..N.../.px..)v.k.K.u....B\|.,.:.o'.y...m...0...nnr..)..q..;`.p...).t...J...46rPr..t..GpM.w.\@......h_...}..$......19..U........s....+s......4.P.>>0cUyT(..%........d.z..Yzl...o...O5.eO......~.R...>....t....N.}._.........^...W1Z..DB.XAbwj.Ta......).w?\......N..y.}3...Q.-....9.E.U;s..V......f.(..Ba0;......m5...:.\|h>....@c...T.z..........L2....hA.}p.6....Q.$.&.&1}.O.O.+."...fD&...1?..cn..\|c...^..n..t.....e.......B..!Q.)...&........N...F.PT....1..y......Q..gl..K.3..d.....g.....5....H..&......(Q..+............x'U.&..N./..GW_.$.,....]}..].)..T.S!........)...LQ\.K.hw.4.c...Z..MS.....0..j...v.\v.5...-\..$9Q..2{...tPq.3\|K../..t.{.....".].vO...h.=..&;..A.Q.......1 (.Mu...!.........i

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.090012084439345
Encrypted:	false
SSDEEP:	3:INhtq4btxbKBf+BiAIFRNVC3h0i7GeYHoIp//uxbKBf+BiAIFRNVC3AYZtXL1h8T:otqWtxbQLZVVi7GeqlcbQLZVZYZ7qT
MD5:	938464F4A51E80A29886967E2DD10247
SHA1:	6CA208768620D334DC104B093C6B816BEFD75CAD
SHA-256:	E5E1650378525B31C2E2805A4CF471C306C690A4F01466044490D53753E83BBF
SHA-512:	D432657412D9A0D75171CFC35F9F3A1DF6383406D76BF299A1EC230E859C2DDA71BF452129956E66538CB652732ED4F8E47BA363691F18C77D61A7442391C30C
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>HTTP method GET is not supported by this URL</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000">.<H1>HTTP method GET is not supported by this URL</H1>.<H2>Error 405</H2>.</BODY>.</HTML>.

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	dropped
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x599, components 3
Category:	dropped
Size (bytes):	128831
Entropy (8bit):	7.967166295665466
Encrypted:	false
SSDEEP:	3072:0MhzfsYRYyfKZJ9gKjPQiU8IGGlFQTnX/6q0USxgI:02zfsifKZJNjGGGoL/ZSxR
MD5:	F7DEF7C2BA05497217EE6B1EDB6F3BA6
SHA1:	E9810E9FCC346908E60DDE9893D7AA08E637DF32
SHA-256:	ED0B282849CE2B31404CF908328A2E5DD353DD9D53D86598524CEF4556C6C6E8
SHA-512:	B1CD5CDBC66F4776EB6CD94D98F61120F2813FD7C84A7AEE40E8958FFA4D3BF44B9865E0135A7E9678401D614BDEE6CC7906903C3942C6B2AE5A3714944383E8
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......W. .."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....V..jx.-.y.$...q..?~@.....%.yB...=T..........1....q.r..$..u.(W.[.....&.$+!....H._..<[....J..2.....i+:...~.......S..O...8...[=8...Z.z.=..Q% ..W..H.a...........\|.z....U..Q.g=..[..Q.xEC....L.1;K......061..J9.........x.Zp.cMn.:U...?.......?.J.R=:..:`}.......@...h......J.1............h<... ....'F...&q..4...>.(..........z...+{}s...A..J.g........m

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 556 x 508, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	426361
Entropy (8bit):	7.995055894705082
Encrypted:	true
SSDEEP:	12288:Vf+0gAl5XgJAJG3z67xS48hye1uwKhemGO8QlY:h+rAJG147kOlY
MD5:	9F9F09424DC578F5D4CF6889B5037CB5
SHA1:	7424EF2ABD5441B2C3EE11F586184A05656C9A6E
SHA-256:	0C2172A71B8EEAD199900CA18E8F72214E8AED423BC266EC3F0E9B1E416B85C3
SHA-512:	8FD6B790E14B135F750FA92071043C90AF629BAADB822D260B48463B51FFA58FF34632058AE66B388DED6429E1B1E47079CCC8981B454E229A1E5143B2071CA3
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/cdata/joinapp/get_bookings_quickly.png
Preview:	.PNG........IHDR...,...........[....pHYs.................sRGB.........gAMA......a.....IDATx....d.%....3...@"..\Y..n..p...3....F.s...$W.UYU..pq..nvTyD.."j.t._......9...e.h......?..\|....i.....i....n......}.},...a.~..v.~.v......v...qX....O..f.EV.v].]?8....O...<..>..\?..m.......n.;....?......[..9...Z7[.{.....z}.=~...~_....~.d~{...~]+.s..p...k.....\kM..........9O<...k.x...?_sq.....xN....=..k.......o.....?.u....fx}.X......1>.3^./..;....9.s....=........_.o=...k.....{..._......;i~.3^.....>.q.+........{^...k.[....9j...&..z.n`.3~.}l..^...N.3/>x\....9}..c..................?{X.Y...=t>..5.kZ?.a9>...w<..@[\|j\|.~.g1.+...9..}^.2x.m......[...z.......7;..X..%....?..g...\|i...\|..^.....=6..iM.3.{.C..y\|s..#~.....y...Y...{......c.........q.......pbOi.c.8.~..{...nqM....y...<].9.....{......g..>.z...1>.......k..V...x..:.:....}~.l.......q.h_O.....XX.xf..'.K[...y>.`....'../.x>`..Y.;...M...8q..>.nO...E.C.\|<..\|..yG......@....O6...O.....s......{..h..'{~.d._>b.....o....

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39991), with no line terminators
Category:	downloaded
Size (bytes):	39991
Entropy (8bit):	5.5213233195563305
Encrypted:	false
SSDEEP:	768:r2/G43KvibvqZsAQI6O9gCfAid7k2pPLX35yIF5YyBy4Y9Lc40HdLSLXteRwftG:roG43KvibvqZsAZ6O9gCfAid7jpPLXcS
MD5:	89E69A4EC4EB1055A7664CFA548ED6D3
SHA1:	8A848D6BFAA7EFBE89ED12ECA984879871118C50
SHA-256:	B31398749FE4FC489F9067C22D929E5C324D7A1691222E68215FEFD2A65D5285
SHA-512:	F1EAD86792D425FBA5C1405F1159ADF8BD1F82B0D18C8BCCD78B44DC77B3B229E67EACB9CDC2E9625D8B10FBB375F9184BA94F17CFA4460DC90F2A691ED568E5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/profile_menu_cst_cloudfront_sd/4f40f2dea8003cfc6a2c6dca6a110cdf2f68fc72.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.jstmpl("profile_menu",function(){_i_("8c3:e7da36bd");var b,d=["\n ","\n\n",'\n <div class="uc-company-section-2">\n <div class="uc-company-details-2">\n ',"/private/bbg_blk_index_menu_header/name","\n </div>\n </div>\n","\n",'\n\n<div\n class="\n profile-menu\n ',"\n ","switch-accounts-profile-menu",'\n "\n role="menu"\n aria-labelledby="profile_menu_label"\n id="profile-menu"\n>\n <h2 id="profile_menu_label" class="visuallyhidden">',"/private/a11y_index_your_account_menu_aria_label/name","</h2>\n ",'\n <div class="',"profile-item-wrapper-hard-split not-active",'">\n <form class="profile-menu__item hard-profile-split profile-link ',"profile-menu__item--active-account",'"\n action="','"\n data-component="utils/form-submit-on-click"\n data-click-on=".profile-menu__account-link--hard-split"\n

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=f667a3ac68470510&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34330)
Category:	downloaded
Size (bytes):	34523
Entropy (8bit):	5.527275394727296
Encrypted:	false
SSDEEP:	768:2mngOrCDURqUqPMBdQXUbZ4IMew/CPPYHQGqJEUL0b:2yqU7tbZ4IsaPPYHQGqJEUL0b
MD5:	A815E76BAA21CAD3E3DA1F9711577FB5
SHA1:	273878A009957EFB26CD059BAF655A4FA04118B7
SHA-256:	EF9199633573E2F5DBA53EA87DD9AE82341299ABFF15B44A22F676BA334A827F
SHA-512:	FEFC8D0F14D30785BC4D6064E9410E1953EFB9C5B964E56DCE182672ABC03503D9E052BF123295770024C29611F61B483AFE3C6B9D272F458C2B42D8BB12EAF4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/18cad957.c8e7c8d3.chunk.js
Preview:	/! For license information please see 18cad957.c8e7c8d3.chunk.js.LICENSE.txt /.(self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]=self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["18cad957"],{47596644:function(e,t,n){"use strict";function r(){return r=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},r.apply(this,arguments)}n.d(t,{Z:function(){return te}});var a=n("ead71eb0"),o=n.n(a),i=n("8521b397"),c=n.n(i);var s=e=>{const t=(()=>{const[e,t]=(0,a.useState)("LOADING");return(0,a.useEffect)((()=>{!async function(){try{await fetch("https://www3.doubleclick.net",{method:"HEAD",mode:"no-cors",cache:"no-store"}),t("NOT_DETECTED")}catch(e){t("DETECTED")}}()}),[]),e})(),{onAdBlockDetected:n=(()=>null),onAdBlockNotDetected:r=(()=>null)}=e;return(0,a.useEffect)((()=>{"DETECTED"===t&&n(),"NOT_DETE

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65487)
Category:	downloaded
Size (bytes):	226735
Entropy (8bit):	5.346118746193619
Encrypted:	false
SSDEEP:	3072:sosn/wOry3D0j+mTUXBwgPl/QC2NwmMxrrSeKdSF8UeZ28m4u7k5GT2/2uReiMmZ:64OrM4aWmd/QC2NwfagFAZBakfRV
MD5:	CAD5FE4C499F7568E14E7AB6FF9B3361
SHA1:	7CF66966B26C499B535EFD53C77F65DF7DA14338
SHA-256:	83F4228D1D92171186E8B8CCCE6E69B32AD6B322DB4AF7E4B6F54CE50E299587
SHA-512:	88320686F20F22AA51C2F9493EE8114A9E613C2C93B6F104FFBFDF7A096CE6A3111BA5ACA7598EE1BA1B4FE953D141C79598C5AD096FC89E81F1370D844AE886
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css
Preview:	@font-face {. font-family: 'booking-iconset';. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwAAAsJAAAAAgAAAAIAAAAEGdseWYAACwsAAJY7AACWOzKPBVGaGVhZAAChRgAAAA2AAAANhact9JoaGVhAAKFUAAAACQAAAAkEqwQt2htdHgAAoV0AAAIDAAACAyG4yWibG9jYQACjYAAAAgQAAAIEAJMgdxtYXhwAAKVkAAAACAAAAAgAiwDLm5hbWUAApWwAAAB5gAAAebQPj6JcG9zdAACl5gAAAAgAAAAIAADAAAAAQAAAAoAHgAsAAFsYXRuAAgABAAAAAAAAAABAAAAAWxpZ2EACAAAAAEAAAABAAQABAAAAAEACgAAAAEAOAAZAG4AhgCkBaAIzAyuD2wQShJEFCQU+hW6FeYWzhg+GIQZ2h1CHcAfZCLMJxwnYieUKJgAAQAZABAAEQASABMAFAAVABYAFwAYABkAGgAbABwAHQAeAB8AIAAhACIAIwAkACUAJgAnAgIAAQAEAbgACQAfABgAGgAeAA8AFAAfAB4AAQAEAbkADAAWABgAGgAjACQAFgAiAA8AFAAfAB4AOwB4AIgAqgDCANwA5gD6AQ4BOgFKAV4BdAGKAZ4BsgHGAegCCAIeAioCRgJUAnICjAKkArACvALMAuwDAgMOAy4DRANUA2gDdgOEA5QDogOwA8ADzgPgA/QEBAQaBDYEQgRQBGIEcAR8BIoEmASqBLgEwgTOBOoBRQAHACYAFgAiABIAGAAWAQgAEAAlABgAHQAWAB4AJAAWABUAIgAWAB

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2363)
Category:	downloaded
Size (bytes):	2479
Entropy (8bit):	5.178474925626043
Encrypted:	false
SSDEEP:	48:04aCJvTLa7tbAekC/fnPGPxqBurgWEgyTJ:5lvTL+tbAekQnPGPx2urgWEgyTJ
MD5:	F22EFE190D4CDFD20E43049D1C12A165
SHA1:	F51CE2FD8089135FD0EA35940D015C41DC4C94D1
SHA-256:	7846A1779E5D575E40796388DD2E7C23E5637ED2E4CD13B82D5AAF4CF444F539
SHA-512:	8FB3BBB7A9079DB43707BCB5B943EEB4728424EC8DC71F7506E8C4652C3E0FE80C21F822825DCFE55CB6BF88A49AD5AD659B7A910E10F90BE3E7B4AF49DEDC1C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/cfbdd235.7a595d50.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360598000&cv=11&fst=1705360598000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	314
Entropy (8bit):	5.259531250480507
Encrypted:	false
SSDEEP:	6:CYQTS4JsSNGhqwXNr2fzR63ZX5h4pIoauw1le:C9e4JsPFNreRYeIoauw6
MD5:	E262F92E286A4C74280BD4B3FDEE8CBB
SHA1:	8339EBA25BEC526F3F7D9EB719BE268966BCF263
SHA-256:	809658CF80A3CC36DD168EB34ABBB4C00671A277CE8E560FA79C7564A9008BE4
SHA-512:	A007EFCC5351D1DF4C08E32AA603848A8EEB652A618A79C50929C04326B1FC6048A0C9E786DC32C0129E33F545A7857BA00665730B6C061A3B518E43D641BC0D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/a6a21c13.8939445f.chunk.css
Preview:	.b2ca975670{margin:0}.fae1400be2{font-size:14px}.a41871ce38{margin-top:var(--bui_spacing_2x);padding:var(--bui_spacing_4x);padding-top:0;width:100%;box-sizing:border-box}.ee574b34fa{font-weight:700}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/a6a21c13.8939445f.chunk.css.map/

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	downloaded
Size (bytes):	90590
Entropy (8bit):	7.97624342479417
Encrypted:	false
SSDEEP:	1536:9yVo+GWbDBLXnCpPP6LV5sq8TGUGy+ZKJExqVW+xPOKd5Mmh2w/UQ4sJx:YoObDxEiRbyCKJHVTWQ5Mmh2GUQ4sJx
MD5:	FBF7CBF73E0D3B7F0D6E22E5188CECE4
SHA1:	013992D9AC52A63AD2D12EF1CFC4E7E51141D8C7
SHA-256:	72E6952E34BA629CA3520C329A6BDEC09619E5A4457D3B89BDAF95A4CAA18809
SHA-512:	F5F2033F5C4DD8085B80292429BF9EEE7CBA38AB27E0F256EEEFD8593351B8DF7BC6D08E4E0307F559847029FECF53A06269236085B0181D9A73C4AEB977D044
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/600x600/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[.2.....I,Mh\....Yl...ry.........of#..K2o.q...{....T.......q.q.....<....\.H.V.xKg.}s.~...K.{..i.k$3&C)9....y.k8#.Kxc\.}....v.....7.a.....Ue.'...a......<...I9.c94..>2..4..m^...e.xP..w.O...>....\|...g.!.OG..7.........u..Y.y...G..r#.0I...H.k..&.A.[v...0.`...r3..U8..;.JM.3..4......T.ly........c..v.9...x...ke..$...Hb.NT.....<z.Z.c.B..KK..W..:.'?(. .s..\.v.jZ.S..

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1017227
Entropy (8bit):	5.370960542955562
Encrypted:	false
SSDEEP:	12288:p4sW59jmomyicwAsukG5JiQanFH8W7RpDoWrt:p4sSsomyiAmfH8W7RpUc
MD5:	779AE6A8726AD43C905CE5A4DC1ECDF7
SHA1:	2FC47A83ABD2194F4985886E6C6B70FD82B4FF5B
SHA-256:	2C6360CE77DA5BF253C1358C103A19EFFA56A6230BB21545FE0F65772D77A22A
SHA-512:	BBD3E45FC806F36181DC0C6C23FEA8257CA43ADA8AB18B349BE7A5B8F98E8DA855512B6D02354DBAC542995262F779531731518FAEB71A91852A4F9E644ED43E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/client.7ef6b36a.js
Preview:	/! For license information please see client.7ef6b36a.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 520 x 340, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7367
Entropy (8bit):	7.954867954128154
Encrypted:	false
SSDEEP:	192:mJHKhAqXcsI/5FTXVJzcT76KNRsN74HTwC9v5cAlQSPgGNNp+C5fKQ:mBAAqXcseFTXVs+ERsYwC9hcm40Np+6x
MD5:	A2BDD966488047AAA17DCEBC5238432B
SHA1:	65C52EEB866EB2ACBD183E5FB2DCCC5205DBB6BF
SHA-256:	CFC71DCDDDA21B32C0AC5BA5322BD41612224261FECDC38CD20A45B6B502457C
SHA-512:	CC6450163167C4659D80D885B5DF1B281AA819C7DC9780D7F874664FDA29C922437E6E6FEB84EADB3900E40B4D0D7441B08369A0F0BFCCD02040B47577745E3A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......T.....v.4@...lPLTE............................................................................................................G}.x...$tRNS. 0@`p......P.....pP....0.._/o.......9.....IDATx....b.0..p..R..a..z..d..P....../7........:.!.......G.INU.....c$.c....^..=..I.^Q$8.S..n7...3.H-.;D>TY.u].....?.a.}LI..XW....\.......G...bf....Jj......y........F.)....!..p$8p.b...-.^O.X.......l=...$.......6..i.........T;...#..O.L.w.6.......DT.t......g.R.R...y.9...I1.....G.N...V.gQ...:>/}.j.T5.?.WvPR}.DL0.....l.....VV).0..\|.H..P.1.%.k....m .....=e..UI5..0f.).n...+{3.nP....`f.0...R../D.I.].E..0n8.....x=......j.?R;Rmd#W5.%..x...59.j..p..j...F.C.%...$.....o.dg.C.,v...g.....b;..T.)..#.%..$......nT.C..:..M.~..GCU...\6@.D.&.aJu.g#..../2<.~n.h...p...A.R..^_..].D.I.5p.At^.O......AI...._....R...a`_%.0.\.d....tp0......BR3.@...8m...X.\|IZ.T.@..P,...7.r...%...\|...a..v...m,..66.L.mi...35K..X.....s.MH....s=~.<3......g.R..tV..Sy*m.....t'.S1..@.cP{..b..-..U...ac

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57217
Entropy (8bit):	5.516425236055305
Encrypted:	false
SSDEEP:	768:g/60KD+xPxev9nB3WtBOediR3/wcJlYRfGkuF3YRqJ/rctKCB:g/61Cj4COedip/wSlYR1YI7B
MD5:	A851AE03D270ED0F1A6B4EE3161B3B0B
SHA1:	3E5983A19355F443E4961283A6BA65F687C94090
SHA-256:	DAD1FDAFDC4B94DFFF3D832BD10D3805E4A2907996DA9D9700047044CBCD4898
SHA-512:	63AA3E835404195B9721B3CD4A00436A6C6B830C3501FFB2A3443F6982ECF00EDDE77C91154AC22866FFDEE03D8F1B54ABA875AE66A5F2422238C61E4137073F
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1628
Entropy (8bit):	7.784928057284059
Encrypted:	false
SSDEEP:	24:DXGHdcP4D/gO2WdAnzMWSYfJhvbsUT/HZwDN9cbMkfYKjOmJeMs1R2t7UB3:DWHuP4XxIHQgHjbMkwsOTME2GR
MD5:	3E32EFD25AC0214B375FC8A6A32890F2
SHA1:	CD46A79DB7E53E19D5869B3CB3E7AA22EE523479
SHA-256:	807C8A1B498E17D227CF48A640B778BDC4398A9852493CB2F40BF0F33651D0DD
SHA-512:	E0F6807657EE1667876D66DCC13CD279C973EAE35E53509E86EC31951B8B07EBBCB0A1B3FC9BBDBC423F436C1F82BDC5C0440F875092E82A47CF51286CDE0C00
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png
Preview:	.PNG........IHDR...[..........2 P....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......IDATh...}l_e...O;......L..S'.G/n..22.bd..s..(d.x...(J.....!....E...%,..2..uceD\|...c.....u.._{[[\Lm3.7.....>/..<...>\|.8F..c...'..=..'{.1N.(.E./.\|......U..#:[./.Y.CY...~.6.X..,..k.F..X...H<...[d....oZ...a.o.T....59#.VL...l,G/.E..y[......59#.c.O..&l.............~\= .dy....2...e.c..d....j<....Y>....wc.f.....3i.3...")..&....b..i..'J!....\.....U....K.0.m.k;.>.o.....1.?i.k...g`.tK...-...U3?64.?...W..d.tl.@~.n.Q.....g...s...........A.V..k.y..>...........,f..e....0.y.... .O.=N..w.t...[p. {.:......N).......VI.Y.uV.....b.,...6=..~...qx.o..j.Cw.vj....D6Sp'.'y.......O..Ml..h_..../.\|...........g.'c....Yq.....O..{../...x.y........o:.WK.....}.,?....,V(..R"......57.,........].. ....<7V....x4t.....a....s1.xo....Q.}.Q.]../.......z..F.v1f......5..qyE.....h.W%{....,..K..[8...\|gE..W.\|w.6....U.g..8..n..q}E.W....S.bo..#y.PxCE......F...J1x

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x500, components 3
Category:	dropped
Size (bytes):	45792
Entropy (8bit):	7.974352553118242
Encrypted:	false
SSDEEP:	768:FFevOGtlL7ksEysW87ScfhjFUe6maghjlsu+Ij+y2IX7Mfy17t6tiheoPB9zwQWU:FFg/tqsEysWBcPUtmaQlsuPj+VILwyR/
MD5:	0333C11DE7B88C4FD1D534D2C0BD59C4
SHA1:	C924AA1DF20B7E1EA8E642CFCACA476088B0EF9E
SHA-256:	5E9A16504FA6E4B9605B63B630CD686120A88BAAD5AB03A9F4BD788479F808B1
SHA-512:	39EBA832DCC54FB6E2629FA8F0F7D4D0CEF7D238BD7D5776141A25F1F6CD0AD2F20A76BD0C95B02EF3B0891B9099B55FDC07C20D69E5A09516B2D572C36D3253
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....K].lh7m....j.GZ..... 0,.... v.v...\......d..Y.z...p]T.T...V......u%.....:`..A$...Z......<..T. ..Z......B........;%.1..-.e.L..+4...]....X./.%\$k.s^..@..\|h...\...1...#.{t>...(...].i..bx.y...W....Z....k0.T5......._..F.t....U5.M..Gf^..>.jK....u....b..?.mx.........k.l.O.$T-.kbk...O...x.\|~g.3...d?.W.Y.<g..w.l....{..6I>.5.>#:...x..~'....\...j..G..O.m..R..[.

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1334), with no line terminators
Category:	downloaded
Size (bytes):	1334
Entropy (8bit):	5.685380830907401
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEz8npRnLhfPqjCC5zqinzYjnpRnLxR23oqnpRnLB:YyLVkczEzAEz8nbtGYnbu4qnbgQ
MD5:	C0CE70D145D67A53299C7E13CE34A818
SHA1:	33D3F547328E8F8B89B49D0E5FEF51CD100EF9A8
SHA-256:	805E9EC24F81107608DB88454219A9AF84C9F8163CB9E5798141386AA286C7E9
SHA-512:	A1263A2822F1E70772EE27950972C799BC15C8EF8C4119D4AEE9CFE2E28E1F44B112F979C3A74766956EC2C4D3738A0DC8FEB1F974A60B7BFAB150F40FF37D80
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1705360583869&cv=11&fst=1705360583869&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_ev=2&tx_gty=1&tx_id=ybylZdSoJtiuoPwP_MWgWA`);</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pa

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2544), with no line terminators
Category:	downloaded
Size (bytes):	2544
Entropy (8bit):	5.976502810888843
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08yJE8A5SVH/KMtpetzYiglh:wsbSUtJfxrqLWWWdV6j18ERQHyMUG
MD5:	D9CB59D7B02399C726291571ACD43EEE
SHA1:	A24ABF2C2EB535ACA9BBB1D603209D4F80EE4C5E
SHA-256:	079FD9BFB81B833D106F319D2B5BBB5F7BDFE2B0F938352035C0919E90F8E95D
SHA-512:	B509FF29C00CC151CBAF4B64E5C7E2EE0B4FA53E206E9A00B47B4A67748A49C1F55A46D167B727405614093E185A65D545A33478B215DCBE758BF3E609465B32
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1705360607644&cv=11&fst=1705360607644&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 260 x 260, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	19613
Entropy (8bit):	7.969431801124411
Encrypted:	false
SSDEEP:	384:mjUbVaLUNIUKCJonomVl0plKjyiJgiMB4/gQsxv2xnQGjQ4SGte5/vjcVwVlRtfH:CGaLUuGqom+lKjyiHMJQ+2ZQgQvGoFcC
MD5:	46A2DE536918E78228AD39F6C9BCED54
SHA1:	BD29519E8B65591AED18ADC02A3ED6C8354000A8
SHA-256:	D0E96C1281514494C432A9DCD3059ED824047ABCF10AD228C6BB7AE7C7D58C0B
SHA-512:	5C90FDEDB841782659E9C0D109C0765930362AD1A72F1BA9FAEF155552F35CE364DD783C72CB640509693FF6C40C4E3ABAFA11E301EDDFAA411F3A35B01BB3F9
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png
Preview:	.PNG........IHDR...............8....PLTELiq......{..................'{..}........\|..}..y........py...6....................X.v.....k.....?.....V....w..r{....r~."u...............^.......G......................X....L...................&.....n...?y...B.......q..r.dx......s.... h..=..o.,i..h....j.Px..m..:.8e..j.<{..:....p.At....k..=..E..]..........W.....;........;.......:..................s.......t.............=..........:................w.....{...........r........~..f....,...n..........5.......2...V..k..\...n...a..M.6..q..k..\|...E....f..2....^..............~....b...u.H...f....%..:\|.......X;e....A...5b..\cc..A O....Ot.....N.voU..M3[..#...3#I.4Qx...FWj:..M....%......z@........9.........RLk.gz.........."C......+..$..i............(c.o.{ .p...v......>.3....tRNS...@...... ...7,H........'...........T}.e...?,}...H;s$^.Ga.K{.I.Ui.5Va.....~...l..s............c.....k........................................................................

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	84412
Entropy (8bit):	5.767736649874497
Encrypted:	false
SSDEEP:	1536:sGnvdjuRJW4XtqzOe1x4uNilJe8R8PwMn:4R8qqyehilJzs
MD5:	DC1F07D2123B75A7DD2F78FE76D8F26F
SHA1:	A5A73E3AACB4C82D04405E5BDC497E5B763997B5
SHA-256:	7CDDA69BF1D2989F6791AE58CBC489D43D391E2B7D5CE16DC198D84EC6F75563
SHA-512:	A94EA3CBC1C6DD27DF6D6ACBAD96199C6F347448AB3C1F6788934B227A29105EE01F135B8A4C1746F34E48A54B51F03462C4C9A26196A5E592941D48B06FB0F3
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/cfbdd235.aa2e272b.chunk.js
Preview:	/! For license information please see cfbdd235.aa2e272b.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["cfbdd235"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return x}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2323), with no line terminators
Category:	downloaded
Size (bytes):	2323
Entropy (8bit):	5.88647557261995
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08rGAKSS7tzYigla6:wsbSUtJfxrqLWWWdV6j12AYA
MD5:	B8CE6DD70D49E2BD91A592EDE482C14D
SHA1:	9F14571A82127A33A6CC1BEECE57A1475C6D7CC7
SHA-256:	8E41A8D9A595DCEA77CDB7F30181578003B9A4BB941A4F283A596D2CEF2EBF9F
SHA-512:	0BBE85C22552BAC0A42B47DB24EB061B0E7809DCD751170720B659D4FB38440AA03138902B532B37A0019C627BB3060189C7A61B3F8B91BBB19A4F98202B1D2F
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360597967&cv=11&fst=1705360597967&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	57217
Entropy (8bit):	5.516425236055305
Encrypted:	false
SSDEEP:	768:g/60KD+xPxev9nB3WtBOediR3/wcJlYRfGkuF3YRqJ/rctKCB:g/61Cj4COedip/wSlYR1YI7B
MD5:	A851AE03D270ED0F1A6B4EE3161B3B0B
SHA1:	3E5983A19355F443E4961283A6BA65F687C94090
SHA-256:	DAD1FDAFDC4B94DFFF3D832BD10D3805E4A2907996DA9D9700047044CBCD4898
SHA-512:	63AA3E835404195B9721B3CD4A00436A6C6B830C3501FFB2A3443F6982ECF00EDDE77C91154AC22866FFDEE03D8F1B54ABA875AE66A5F2422238C61E4137073F
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15361)
Category:	downloaded
Size (bytes):	15477
Entropy (8bit):	5.231524940099099
Encrypted:	false
SSDEEP:	192:kBMkOgdhLs02BFLHFifVHpvAJMg/fDUG3vtctzenzZ56ix9oQPxOhQvaHtTpBQdT:kBFc29oX3zSpedpee
MD5:	4066F4E0B6C463342177866CFB14BCFE
SHA1:	42040558C4583F4B97CEEB37ADB47B2971919DF3
SHA-256:	E136C33D8694EDB0EA24A8D458130E930509DBE71D4C8B611AB943D592112F77
SHA-512:	7A40EFBA25D72031B8E089702781059EDE6FFCCAC827E6C49C57B78D6982B302C319E6EDA7C32B25C813F975A3FC4C61F7D1BFC843431232C55927EABCFB9A30
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/8207c303.462834bc.chunk.css
Preview:	.c9a7790c31{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x);margin:var(--bui_spacing_6x) 0 var(--bui_spacing_4x)}.e22b782521{box-sizing:border-box;border-radius:var(--bui_border_radius_100);background-color:var(--bui_color_white);display:flex;flex:0 0 auto;margin-left:var(--bui_spacing_1x)}.e22b782521:first-child{flex:1 1 auto;margin-left:0}.e22b782521:not(:last-child):hover{box-shadow:0 0 0 1px var(--bui_color_callout_border)}.e22b782521>div{align-self:center;box-sizing:border-box;padding:var(--bui_spacing_2x);width:100%}.d12ff5f5bf{background-color:var(--bui_color_accent_background)}.c9a7790c31.f200fcc81a{flex-direction:column}.f200fcc81a .e22b782521{margin-left:0;margin-top:var(--bui_spacing_1x);min-height:50px}.f200fcc81a .e22b782521:first-child{margin-left:0;margin-top:0}.c9a7790c31.e79e8c68d5{padding:2px;margin:0;box-shadow:none}.e79e8c68d5 .e22b782521:not(:f

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5619), with no line terminators
Category:	downloaded
Size (bytes):	5619
Entropy (8bit):	5.417620647133485
Encrypted:	false
SSDEEP:	96:jBk1uC0QWpquQRZ5xPD+ePa72OCvR+2v4KC6Jt4hM8ixH0MMn8Y5xg0KDlvoj5+f:jNCCpqHRZ5xbq2d1gQxH+8qwBSQvAgAi
MD5:	023FD7251563F3D53A56E92130146DCC
SHA1:	0E8228EA58A086A73E3FCD8E914B5759AFFE5E7A
SHA-256:	994EC33DE4B9253B6ABBF26965DAFB40C822E0B333E334456BE7FF2A6FA638FE
SHA-512:	900F8A68AC5AE4653B2D3CA64AF79E0A9B29577DDC2A07687D781B5B0E98F5CD4CC71B07BCDC221E1297B9998193D22CABDA1A7318FAA846AD03450F7B857131
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function ImageLazyLoader(){_i_("796:a3c4e208"),this.highResQueue=[],this.shouldLoadHighRes=!1,this.viewPortExtendedHeight=null,this.isWatchingForNewImages=!1,this.supportsIntersectionObserver="IntersectionObserver"in window&&"IntersectionObserverEntry"in window&&"intersectionRatio"in IntersectionObserverEntry.prototype&&"isIntersecting"in IntersectionObserverEntry.prototype,_r_()}ImageLazyLoader.prototype={SCREEN_HEIGHT_COEFFICIENT:1.4,SCREEN_SIDE_COEFFICIENT:1.33,LAZY_IMAGE_CLASS:".js-lazy-image",init:function(){if(_i_("796:ba3462d7"),this.watcher=this.getWatcher(),!this.supportsIntersectionObserver){var e=function(){_i_("796:8f1a9933"),this.viewPortExtendedHeight=(window.innerHeight\|\|document.documentElement.clientHeight)*this.SCREEN_HEIGHT_COEFFICIENT,_r_()}.bind(this);window.addEventListener("resize",e),window.addEventListener("orientationchange",e),e()}document.addEventListener("readystatechange",this.enableHighRes

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (737)
Category:	downloaded
Size (bytes):	853
Entropy (8bit):	5.277483296688978
Encrypted:	false
SSDEEP:	12:XfYcuq8hvhFxVpJW1VVLOgSqut1GexVWSzwB68a5ZwKtLOxEXWr2IoauwTBo:XAvq8hDxV+VKuujVbEB6PvixEXq6
MD5:	6F3E8BB7938A05E927B3CA4454F98FA8
SHA1:	C4E87597CFEB98F0BE34F2163978CD85DA36B1CD
SHA-256:	28A8DCCC02F121F8EA78E7CD78A70494B6593CB8345434FEF99D6B739DC5D1EB
SHA-512:	E24D656D6CD12AB29EF408F26809B5ED5ABB1552FA67D21576C903B6262867DCFD047D329DF25B0A5CE85B87369A7743F6C8211B4D764922BC9DA600A5DBB8C4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/c6a78acb.bffda4a9.chunk.css
Preview:	.c779636eef{background-color:var(--bui_color_brand_primary_background);border-radius:var(--bui_spacing_2x);margin:var(--bui_spacing_6x) 0;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.ff75376f23{display:flex;margin:var(--bui_spacing_4x)}.f433c16992{height:120px;display:flex;flex-direction:column;justify-content:space-around;align-items:flex-start}.ce6613f3e7{width:140px;margin:0 var(--bui_spacing_4x) 0 0;align-self:stretch;display:flex;justify-content:center;align-items:center}.rtl .ce6613f3e7,[dir=rtl] .ce6613f3e7{margin:0 0 0 var(--bui_spacing_4x)}.f742f17cff div{color:var(--bui_color_white)}.c6286cd018{font-family:Avenir Next,BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/c6a78acb.bffda4a9.chunk.css.map/

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.756974676688925
Encrypted:	false
SSDEEP:	24:zn1XTOSh5oncvg3/pzi9NUvZi/GZu4yVEb6cgfes54AVi8TgBgWPPKWfW:zde/3x+1OZkEbhgft5TbTgdPDW
MD5:	6384185CBE9A4F106857A3CB85CAEA98
SHA1:	0E31A4FE2CE98A8B4FDA60687AA71079B4D3A95B
SHA-256:	5839F0330821CF08029BEDDD6D248170DA1AF16CD7AFF253E7BD075D591F5D42
SHA-512:	E9C784DACADEAB6C3FAD53729701708EC5C21670086AA981953FF2D44DFB08BE13134707A4E7405826CC0D11C68F3AECFD6601AF910C537F6E14AF68175B50B7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...O..........w.....IIDATx.....:..sl.g.ym.{ll=.m.m...f^.A.1zhg.i:...ZM..5@.YF.................o....hU9......B.s.h....<......=~........b..'.....5.l`..V...z...b5...E.........8.........f.C[.lS..z.IcI...X..r.:......x.Y.....}+.h^G....3......6.Ni..........G.......S.....W.Is.I..S.`.e..)p.hh..T....`...Q.....V......".}.X8..v........k......84.....-9..d.....lq....FuA.zJ5._..@cX.../....a..y.....;.r.>Lur[.w......O._~..:h+H..>.y...p...4..{.\|aBu..y].....a..w&L0.Y.e..}U...'.s...=.......n..^.r...+].I.-G...r....8].FkR.'.......u..e.c..w..%@.}.e...#..K..w..Ak.[@.R..gY.u.2/..y.Q.n.O.......]y.n..pk8.s7.......y.:..F...M..h......y....`..O....i.zqp..<........Zp..h.+..@...;/.#...0..u..N...v..)..6Oq.d..n<.M../.....0....EMn...3..=Q......r..../....8...'..wv/.w..'MS...[..........<.y}...4.Nm....qk.9d. n.Y....yZ1.?..!..Dg...m....;.N...A...I3.gn.]G.A[.w....7.6Om.........zD....v....._.D3x.v...6.]WR..7........=.."4.....\|.......:...a...Z....~..\..~

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25190)
Category:	downloaded
Size (bytes):	42390
Entropy (8bit):	5.508489032246762
Encrypted:	false
SSDEEP:	768:J+i/6VUbdYCemxJzl516Uk2a++IhJ8aq9EpTEDGOzGx3vcMaG:JMVUpemfz16U7a9Iz8spTPOax3UMl
MD5:	E7E49FE6C519EFCD2B1E0EC1E46FB402
SHA1:	24228143FEC83DAEB8B6275CAF9A66D2089F09EA
SHA-256:	E5FDB3EA4CC4CF6B0F77FCE3B54D03D78A697BEC33BB1A023B964E8BE16AEA5F
SHA-512:	56D723428B584CB41DDF20BAD5B14C5CBB5EB42C746E2D5B4A8A1F0ED5674463C10E42A5EC59F32A2B10693C7D201F2C045C1AA2C87391520EF85249E951753F
Malicious:	false
Reputation:	low
URL:	https://sc-static.net/scevent.min.js
Preview:	/** Snapchat Pixel SDK */.!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,arguments)};function t(n,t,r,e){return new(r\|\|(r=Promise))((function(i,o){function a(n){try{u(e.next(n))}catch(n){o(n)}}function c(n){try{u(e.throw(n))}catch(n){o(n)}}function u(n){var t;n.done?i(n.value):(t=n.value,t instanceof r?t:new r((function(n){n(t)}))).then(a,c)}u((e=e.apply(n,t\|\|[])).next())}))}function r(n,t){var r,e,i,o,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return this}),o;function c(c){return function(u){return function(c){if(r)throw new TypeError("Generator is already executing.");for(;o&&(o=0,c[0]&&(a=0)),a;)try{if(r=1,e&&(i=2&c[0]?e.return:c[0]?e.throw\|\|((i=e.return)&&i.call(e),0):e.nex

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 146 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1113
Entropy (8bit):	7.682854542858676
Encrypted:	false
SSDEEP:	24:d74HzGiEcrffB/6F138cEMRvqqzz/XlYm7rx0ZxgSKoAy7QLWwSe:d7kwc7B/6FecfqqvXlYo0ZZAzz
MD5:	E52554235B2E8390DD41AFCC3E7457B2
SHA1:	CABC89FD270FCBA783077ED3C43A322C68322D9A
SHA-256:	92635446E2AEA633E003497722B76994E131472350BD423B9B3C23EECF7A0CAB
SHA-512:	48F2BFC00044F06FDB844F7BC25489094E007FFE42E4BCEA52DEBF2145A165AD3DADFE6892E1829CFC71514202831AF91433CC7C7821C35DAF8A813BBB56D7AF
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/ChannelManager.png
Preview:	.PNG........IHDR.......x......z[X....PLTELiq..U..U..X.....U..U.....T........U........U...........U..U..T..............U........U......C8@B8A.}........U........................Wl.K...."tRNS..:.w.e..e=...O.....,..Ep.x....U...T....pHYs................GIDATx...n.0.F...N6.i..5M.....a).....G..FA"G./....B.P(......M.\|..Y.I...)xO.x[.:..:.2(.g...D3...].$1.+y}.d/[H...l..Q.qK.....9...T...g.P.H.~lki"z.D-...W.q../.;]..m.l..j1....%.....#....l).k5$]c1ry.!.\|.......t&.......Y.~iv..........v%....:...`}...i[....R.FWJP.$,.4M.g.w3.R...e-....cp..W2..,...).UJ_.].....Xf...J%.\|..+..J....f.'B......R....3.S.q._..A.1.7.R...n>^.NZ....5....1....7\..IY..3).J.).....{B5.....E!.+.uU7/9....KG)(.pb..bjV..R....F....r^.(!...4i@.......QGu=-RB).2..\|.4...4.z....A...^)F.c.<.>hJ8......T.P.>mF....G..Z......_.7.Bc...V......2.q.]..&'..0<...p.^K.........c...7..V.9<4!D......GK4^K.R.....'..X.3^.,D..dA......U...%:..`\...\9...K.3\|d....uj..A.K......T..B.d.#...~.......Ey.Y.....c.[.N...n

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	360202
Entropy (8bit):	5.109627410568377
Encrypted:	false
SSDEEP:	6144:54WNoSXzLCZVeASAQLAlPPEgxpeWMSS8n1gDLh:mWNoSXzLCZVeASAQOEJSS8n1gDLh
MD5:	6E045F1C8802924837DB408878018EED
SHA1:	6CB35DA367F61F916DE0A2B9EE722F3DB90BDA36
SHA-256:	E764C451970834698A62BCCF98E1316BBDEEBB8706554A3246BC979ABE70861A
SHA-512:	C7D97544C003FEFEABD084ACD9446AB430EAD734B2A269A241C07E459D30480C57309190A7EB858E55BBC4C8DE91A468091CB6E5DBAF66842343293DC065ADDA
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a1d6f1ae66ba2355300f85f32baadeeae31a7131.css
Preview:	.hotellist{clear:left;position:relative}#bodyconstraint-inner{min-width:980px}#bodyconstraint.bodyconstraint--full-width{max-width:none}.t_m_viewport #bodyconstraint-inner{min-width:inherit!important}.more_rooms_link{font-size:88%;font-weight:bold!important;text-decoration:none!important;color:#333!important;margin:0 8px;padding-left:12px;background:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow/ecef3c58a3c5ecaa079fd68a86909cb9eeb6d743.png") no-repeat 0}.more_rooms_hide{background-image:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow_up/a55dbca344ca9a6bfe12628f2b42d373be8905e8.png");padding-left:12px}form.improved_group_booking_block2 .more_rooms_hide{background-image:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow_up/a55dbca344ca9a6bfe12628f2b42d373be8905e8.png")}.hotellist tr.hidden{display:none}.sr_item .hotel_name_link{font-size:20px;text-decoration:none;vertical-align:top;word-break:break-word}.sr_item .sr-hotel__name{padding:3px 0}body.j

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=7ceca3a89c6d001e&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	420655
Entropy (8bit):	5.349824066254744
Encrypted:	false
SSDEEP:	6144:9XqCzGIQnxhqPIMs/7ooynNUO7yWE7qjEhQBLnqvxyYKFKs:1qjnxhqgUE7qFnq6V
MD5:	E299B47727F3FBA334AD8BD6109CAB04
SHA1:	A5B4E82B461552AA131DE3F244D2BCD89F3FEF73
SHA-256:	27FF6F8B30F633A9E1954D6CC94756127292AA99560255E414BBB75B37416594
SHA-512:	2937C88A68B603D253E69BE88B802FFE619DF35E143B1222B46DF96DED15970F219BDBB65B1D65FCE003867507476B7A6E5C711CD505755641E486C10B2DC8E1
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202308.1.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v202308.1.0. * by OneTrust LLC. * Copyright 2023 . */.!function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}N(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(fun

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=1a065792-be81-49f6-b178-47e74a8775d1&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=3329&m_fcps=3006&m_pi=3312&m_pl=6960&m_pv=2&m_rd=8599&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&trackId=2cfd8eee-8e7d-4b46-a553-5748470cbd20&ts=1705360608302&v=3.8.0-2401042024
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5955)
Category:	downloaded
Size (bytes):	228113
Entropy (8bit):	5.569767589854264
Encrypted:	false
SSDEEP:	6144:G0R+vWIMPPdte6ktV9eUpDmKgB+piuj7F6:6OIMPPzFKgB+piOM
MD5:	57B38BD74E0B5A794AF9CAD7140B845F
SHA1:	19F8BD4514F7AF909E0E9E645A7C8E087AE74C3D
SHA-256:	333B69721013DAF77D6A3864CD274A2F0E38DD54FFB1EA7C45054FBED311B7F1
SHA-512:	6C3256310627629B2CA02251305E842858DA1D40087E7809A1C67BDBD02E2D3C6E914E3325BC20D6FB1EAA2DF94E8AD92AA770CF73D5292BA8666124FAA5E52F
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-FPD6YLJCJ7&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":false},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_referral_exclusion","priority":7,"vtp_includeConditions":["list","booking\\.com"],"tag_id":111},{"function":"__ogt_ip_mark","priority":7,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",4],"vtp_enableIpRegex":true,"tag_id":113},{"function":"__ogt_1p_data_v2","priority":7,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_c

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3221
Entropy (8bit):	7.926541742311065
Encrypted:	false
SSDEEP:	96:rIGMcponR70HgyaFrym+U95ICrxP5rxwSlA3hf2ZMAo6y:fFond0HgDmDCr3lm/D
MD5:	38784D782A29A302DAB9135D63AEF953
SHA1:	04DB0E863A35062A355C4B2EA9585EC83C4FFC3E
SHA-256:	8561E200A6A57195E480ED9D893B14579EF6ACDEABFBB3FE22B5E4EC9B84B455
SHA-512:	741DC6204353821D6CB76E16E36AF4176C1518EFC22AB064BABAA0D21DDB8BD9BA5A08F10A82D899DF3D880E5AF8BE76037CF342813D0D22A02A9558AAD12C67
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png
Preview:	.PNG........IHDR...m............/....sRGB........OIDATh..X.pU..>........(* .T......V...Z..m.Nk.."..CE..M\|..(-K....:.X.....Xd..P.(E.B.{...;/.&.3.3.3.;...;.?...._.%.8....("PD..@..".E........#..7.K.?.Q2.Z....=;......)..1.\|..,..n.\..,......R=/U<...../F...:.].\|>Q......O...#>.RUV^.\|.Vb.Q..%k.RB.a....8........h...O.=...Yu...q2.6.y.9...R~...@...2.........X.R..._=.../.\|..=......q~..G.{..w.......}.< g.#..!....}#-.........2...8....k.r.(.g........'..1...XF-..:...S..#..qny....%6.y.....h...GF..rMr...o.@f.J....../.+.}.j.G\ ...?.>..j..x.Q..a._.....(......(.i.xky.......tGGE"..BiH+.__YK7V7D...'.I..d.N.oj......c.$#...1..........`DV5...x....c...$...1..r...#...)..n..T.....DzsucX.<=.1p.....G&Q..............3.k\..4.............l.Q3.".t...WE.).i.O.U7.5...'.j..1.o...u..DT.d.D.W/.....T5...G.R.Cb.vG...B.Q2X..../s:Wn.. ......z.1.k.9...Y-......F5.zt......(...I~.....~..:....^.k.8!R.~.x.H.W.Y $/W#.*DB...[<.1..U.E....Z.-..F.n.l._e..d.q..6C.k\|..8.......j.$....

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	247198
Entropy (8bit):	5.43892231185021
Encrypted:	false
SSDEEP:	6144:rQuti2pGLwVurag1OTzHKhjFkVRGL8kNVxjA2ibr8r:cx1
MD5:	5CC5D35B05C9D01560ADD9BF4B5F350C
SHA1:	C975E31EB2088A490DA37A94FDF1D86A49802C79
SHA-256:	C5759677F0BFAB4FEC44ACC9BF4B8A7EDB433004D13DF87E84B9B4ABA2EC9AB4
SHA-512:	CD7D618ED521BD547E950A86E4A8384FA40729948539109DBC5358DD8C6F0F01FFA4749EE32B3B57FA0DAF8F3B848AB3142A4E91E54E845799F6E9FDB4E4BD53
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchbox={loaded:!0,run:!1}),B.define("caret",function(){_i_("4ab:50a5d6aa");return _r_({getPosition:function(e){var t;if(_i_("4ab:1399bc4f"),!e)return _r_();if(document.selection)return e.focus(),(t=document.selection.createRange()).moveStart("character",-e.value.length),_r_(t.text.length);if(e.selectionStart\|\|0===e.selectionStart)return _r_(e.selectionStart);return _r_(0)},setPosition:function(e,t){var i;if(_i_("4ab:536e7091"),!e)return _r_();document.selection?(e.focus(),(i=document.selection.createRange()).moveStart("character",-e.value.length),i.moveStart("character",t),i.moveEnd("character",0),i.select()):(e.selectionStart\|\|0===e.selectionStart)&&(e.selectionStart=t,e.selectionEnd=t,e.focus()),_r_()},setSelection:function(e,t,i){var a;if(_i_("4ab:b3966198"),!e)return _r_();document.selection?(e.focus(),(a=document.selection.createRange()).moveStar

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5571
Entropy (8bit):	7.911129446769755
Encrypted:	false
SSDEEP:	96:ghIE2tGm4eGwtSB/zkLS0XcggJr+HvXr/hhGtcYZskvU:mIVtQeGw4lzWSQc3evXr/hwton
MD5:	F496F8B627C128FFADC8772E29C8D712
SHA1:	92D9EAFCE5AFFEF1158743BF1AC768703096CDC9
SHA-256:	9CD751C772BE140862566B72806AB9157C1AEAB1F02942EC4B2627995446DA6F
SHA-512:	6E33458F7ECDC24AE944CB7D7F9CB84F511A229E0103B6FBEFF3F629FB5874E28E9A26578137E56F2ACDA98C2D45A840CB50902CC6396C2AEB413F9E9E9BECED
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M4.M5...M4.M4.Fj6.MF..Dj&.MD..F..T.Q51..0..i..4.O4.T&0..<..1.4.Nc.....Ns........=(..M4P..dT..{o.....@.h....?.L..m7I.s.$.OR....R.S....E2d.....d...\w<:...EI.".....9.?_.Y;.<..j.w....{..?..U.3........f........}..?J.4.(S.....G.[.3..}.P.........=/S.At......o...+..Aw.h....hgD...;.y..(.../...7r8L..i.9Oi4.\.ZG.&/3.b.s..z.....#64.mC..L...$pJ.<..p?.C.b"j..V...DMQ1.Z

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	6.299213971363517
Encrypted:	false
SSDEEP:	24:DRINGdp3+42X9tK0Td/YpgLWnTmSPq/rZZhwjeqcJJG0ZtNy6LBiyy3XX6w:DCc3YNtK0R/YrnTmSPE1Z6sJjy+B8n6w
MD5:	B6D0B31340D7A113F63B936E23D06F78
SHA1:	268E3856DA737F7E56E679258949EF70DDDE47F4
SHA-256:	18C62988860A8FFD90BAB6376B4FE36A723BD39403C420D3943AA3EB5A0029C5
SHA-512:	FEF2D5BA4648EE1BA476E3FBD4852E52F93A0F40988F368AF90DF4188F64E6DCB09BDE79887A4AB3FE81774168D84E6DFCB61AFBA44DC6FB56C3C72D808E23DC
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...[............b....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................If.....tRNS...........gx.]:..HR.0..#(..$/.+!....'-.....;...h\|ZW...u....iK..o....`e.....pP"...t.....V.....rO..... N..b..c.sm..3..[.4~.9.I.....M..n{.^a...UL.?...6T.l..<...@...B\.7...S........bKGD...-.....IDATH....WLQ....t!.\..b..S.4M2. 5..2#N.]NE........&B.T"..\.?.L.I..j...e.k....u..k...dA.......(p.. ZB..k.u.....e..BB7.bo.

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (45002)
Category:	downloaded
Size (bytes):	107170
Entropy (8bit):	5.684499924694159
Encrypted:	false
SSDEEP:	1536:gVew5C1iLVpt6dAF4yngmMxBpJuNpvpuu2ivAtgG+:gVMiLnPgmMxBpJuNpvpuu26
MD5:	75DD5FF1FEF054595851C75010CEEECD
SHA1:	DD5D9E722DDF0ED3CB74383D6A4E99282895959F
SHA-256:	FB2EC1D5E95E1F36B8B6C3F96640520917D4DFE996DF66FCF44414140ED187E7
SHA-512:	D49010C15BC45ADF06DDD95C6DED159C2D9AF74D2101E012935E086A1E4A56044959E01B778A717881483EC86D9A751F9EC4336CD29AA01AAE460D23B770ABD8
Malicious:	false
Reputation:	low
URL:	https://join.booking.com/?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b5d1abbbd&utm_medium=frontend&utm_source=topbar
Preview:	...<!doctype html>.<html dir="ltr" lang="en-us">.<head>. <meta data-react-helmet="true" charset="utf-8"/><meta data-react-helmet="true" http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/><meta data-react-helmet="true" name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=5"/><meta data-react-helmet="true" name="description" content="Attract more guests to your apartment, hotel, vacation home, B&B, or guest house. No sign up fees, plus 24/7 assistance for you and your guests. Whether big or small, an individual or a professional, start earning more with the largest online travel company in the world!"/><meta data-react-helmet="true" name="keywords" content="Reservation, List, Booking, Guest, Revenue, Partner, Advertise, Online"/><meta data-react-helmet="true" name="google-site-verification" content="pBhMOAABbAtGEIxN-yAjwviObnUjUSTtaWEx2pjaP8c"/><meta data-react-helmet="true" name="google-site-verification" content="3YFv-KjdGEM6p2eRaQvLbzo30iTU3J8abJmmOXA

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	83080
Entropy (8bit):	5.765537154896036
Encrypted:	false
SSDEEP:	1536:uGSvdwaukJmcEbMzae16nUNilJe8R8PwMt:xkkJM+e/ilJz+
MD5:	E8ACD113D90EAD00A8A9F3CF0530CECA
SHA1:	974EF34EBD26BF5744674A98F5DA5CC218325420
SHA-256:	64BC418286EF6716C3AABF88182FFFED4F940606B17F11D4B72B8C3D41DA4351
SHA-512:	EAA23FA6D6F18B65D2A4FBC032B0A1BFF64A2BC83BAF326B36997D4F351021BB8AAC4D0E0405A652BCC173E1C45EE2FDF36C20712B27F54EBECD4E1159A92859
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/445be7a9.21674fdf.chunk.js
Preview:	/! For license information please see 445be7a9.21674fdf.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["445be7a9"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return $}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35638)
Category:	downloaded
Size (bytes):	99919
Entropy (8bit):	5.715164532534083
Encrypted:	false
SSDEEP:	1536:DH7VYjBmDZuooO5cALQuqMws3Y8Saw4mSCjHhe:1YjwRQuqMwMNb
MD5:	3CF65176BE5CE49E193370BF22914B59
SHA1:	CCA8434248B134750B12695DCB0A1D75AEC5CA2D
SHA-256:	707B19576BAF8ACDB9A89228506D53F16E61CD2AFECFF1E25089CD4FF460CF6A
SHA-512:	55EDC1DD84B109F4AC6DDF2920FBE2F4E6792F87BA2CD5293CD3B2BBDCBCE51549C51D5FE3C6DD6BD82585F059CE484D419E9E68E5557F73408E27847A8E18C9
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/tag/js/gpt.js
Preview:	(function(sttc){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),ea="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),u={},fa={},v=function(a,b,c){if(!c\|\|null!=a){c=fa[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}},w=function(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in u?f=u:f=da;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))brea

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2745)
Category:	downloaded
Size (bytes):	2861
Entropy (8bit):	5.139906240819931
Encrypted:	false
SSDEEP:	24:vwq8hDMEUZIOyxDj3c3k/Ehi6QEh8rZORUNoAQxlBENhXyQ565hDhpSZCzyCYrUt:vFGDMEKQjoWNOR8wlBTNMG0Wq9YFP
MD5:	8B761ECF11F6B807D0D765EE8CD5851E
SHA1:	02D6D3330BBD5E21A31AF2DBFD39169978FC309B
SHA-256:	1697CCCBAF108B5141E1C98485A4EF4558AF762868B1A7CB4D69A8BA04E08118
SHA-512:	E3DE452CDFAFD4C467D7F049CAA32890E171FA33CA1ED438F7F830FAA63D8EC2B439BF5013E4D574718A84F3B11F14B12F315CA57B041FA80EEFF77DBD938015
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/7bcb015e.5b709f3d.chunk.css
Preview:	.bc4e2c467a{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;margin-bottom:var(--bui_spacing_6x);position:relative}.b8e920e088{text-decoration:none;text-align:center;display:flex;justify-content:flex-end;min-height:230px;padding:var(--bui_spacing_4x);overflow:hidden}.d39c27f89b{position:absolute;bottom:40px;left:-20px;height:64px;width:64px;background-color:var(--bui_color_accent_background);border-radius:50%}.d875fc0c4c{display:flex;margin:-100px 0;min-width:400px;padding-left:10%;flex-direction:column;justify-content:center;color:var(--bui_color_white);border-radius:50%;background-color:var(--bui_color_action_background);position:relative}.bb44aa69aa{padding:0;width:70%;text-align:left!important}.de7f9979e1{margin:0;height:32px;overflow:hidden;display:inline-block;vertical-align:bottom}.ccbae5d425{margin:var(--bui_spacing_4x) var(--bui_spacing_16x) 0 0;min-width:50%;max-width:70%}.a0670806ef{padding:0 0 0 var(--bui_spacing_8x);max-width:360px;width:40%;margin-righ

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	215020
Entropy (8bit):	6.080046239404213
Encrypted:	false
SSDEEP:	6144:drpRtnMZNk6A28X25M5H6uYMSfj604GPnv:d/t6s0zM8giv
MD5:	CE1B060A535136EEFE1C7D1A63051046
SHA1:	5EF65C5DF4928E8DE44515AE70F1B09FE7ABD2D7
SHA-256:	037BCBB173AB1B17B23028FEF2C8BDD660F315F9FE2B1432E9F4EA39372644E9
SHA-512:	75F5FBBEFE8D82E1E2102FC442C2726832DB98CF4E1FD0DC4C551086EAA7E7A7A8817EAD11E00778846E3D6680108992933BE539FF3F17A8160117F498CBC53C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/eb60141d.11bec58c.chunk.js
Preview:	/! For license information please see eb60141d.11bec58c.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["eb60141d"],{a6c91b97:function(A,g,n){var e={"./ad.png":"1b0e14ba","./ae.png":"79f4f2b2","./af.png":"47af882a","./ag.png":"ba989a08","./ai.png":"3fb7150c","./al.png":"a3f433e7","./am.png":"a720c5ab","./an.png":"2b655bfa","./ao.png":"59209aaf","./aq.png":"125a0ea0","./ar.png":"e6dce2b6","./arab_league.png":"2dc8a495","./as.png":"a027ae2c","./at.png":"21bd6a9c","./au.png":"6e89bff7","./aw.png":"b1f7eab1","./ax.png":"6067b69b","./az.png":"82701119","./ba.png":"ddafd303","./bb.png":"1803e935","./bd.png":"77c37d20","./be.png":"416a1ae3","./bf.png":"0bfbb5ee","./bg.png":"62c47655","./bh.png":"a675732a","./bi.png":"032a5203","./bj.png":"141d0cdb","./bl.png":"38f97126","./bm.png":"a489fcfc","./bn.png":"b8af7d74","./bo.png":"ecc4b24a","./bq.png":"b05c71ef","./br.png":"3b22eec4","./bs.png":"7128c28c

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9646), with no line terminators
Category:	downloaded
Size (bytes):	9646
Entropy (8bit):	5.600276426669384
Encrypted:	false
SSDEEP:	192:jLkdu0NVSo1eS0dBoqQgON9tv2Bq8Phv23MwvsWfMVB:jQdusVSo1eSCoqvONOPpcKh
MD5:	F9D244B185BA0038EFF07F1E826A4BA3
SHA1:	D87CED00A66EAF3F7A175C278D2C8529C090829C
SHA-256:	B3B89B5B662B889776580C4AFA89727038D245C66F6C837D01627D2C487F1FFF
SHA-512:	DFEE4C60DC82CA1CE72000906AD57450656C9D01A728A01B87616B3BD9EC7B1D5EBE173BF7CC7A77C1A3A096B024B8F4DDDFB64D73F65F54C69C347BC186B64A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};B.define("utils/bind-all",function(e,t,n){_i_("fe3:ca20d562"),n.exports=function(e){for(var t in _i_("fe3:fe723711"),e)"function"==typeof e[t]&&(e[t]=e[t].bind(e));return _r_(e)},_r_()}),B.define("component/sp/map-card-component",function(e,t,n){_i_("fe3:a635e494");var a,i,o=e("utils/bind-all"),s=e("events"),l=booking.env,_=booking.debug("sp_on_maps"),r=B.jstmpl,c=e("et");l.show_rocketmiles_av_frontend&&(a=e("rocketmiles-on-maps"),i=e("rocketmiles-api")),n.exports=e("component").extend({init:function(){_i_("fe3:f68b7edc"),o(this);var e=this;_.log("init sp_on_maps"),e.badgeTemplate=r("loyalty_badges_maps");var t=e.$el.attr("data-loyalty")\|\|"{}";e.loyaltyData=JSON.parse(t);var n=e.$el.attr("data-has-rocketmiles-extra");e.hasRocketmilesExtra=!!n,e.checkExtensions(),l.show_rocketmiles_av_frontend&&s.on(i.events.SR_RENDERED,this.updateRocketmilesExtension.bind(this)),e.bexContentData=JSON.parse(e.$el.attr("data-bex-content")

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53167)
Category:	downloaded
Size (bytes):	194024
Entropy (8bit):	5.16295921273475
Encrypted:	false
SSDEEP:	768:W3gjapTIuIkF6lavvawlUGvBMAbrU7r6SK3vTDCb1I51bgyTkph/GW0hjXeXE128:W7ClavvawlUGvBMYqK5YPGs/DfdfpR2P
MD5:	1D8C553AEFACE7C02F954F9D5941504E
SHA1:	93891554E1DCD585C424F61C99ADB48E989934A1
SHA-256:	E13CA72404E36E6EAC3C78634840FC19BD54573229D3ED0F78C40D6333F1AC47
SHA-512:	9D1F29EDBB9774DDA43659591FEC71311EABE9C70A9BEE9D2CD92C50242C5E8823341360A44157C9403C4710112BBAE9ACB00D51867B463BF314B5D48560AFD9
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/client.d20f8859.css
Preview:	.fcd9eec8fb{display:inline-block;fill:currentcolor}.fcd9eec8fb svg{display:inline-block;vertical-align:top;height:100%;width:auto}[dir=rtl] .fcd9eec8fb svg[data-rtl-flip]{transform:scaleX(-1)}.fe255d8541{display:block}.c25361c37f{height:var(--bui_spacing_3x)}.fb4ef8dd02{height:calc(var(--bui_spacing_3x) + var(--bui_spacing_half))}.bf9a32efa5{height:var(--bui_spacing_4x)}.c2cc050fb8{height:calc(var(--bui_spacing_1x)5)}.d24fc26e73{height:var(--bui_spacing_6x)}.dbed623b69{height:calc(var(--bui_spacing_1x)7)}.dba56f70c6{height:calc(var(--bui_spacing_1x)9)}@media (min-width:576px){.b138cad1f7{height:var(--bui_spacing_3x)}.cde2354efd{height:calc(var(--bui_spacing_3x) + var(--bui_spacing_half))}.ed0fdb6b63{height:var(--bui_spacing_4x)}.f8f9489c14{height:calc(var(--bui_spacing_1x)5)}.eb3b554a94{height:var(--bui_spacing_6x)}.cdd57dffd7{height:calc(var(--bui_spacing_1x)7)}.d76926d4a5{height:calc(var(--bui_spacing_1x)9)}}@media (min-width:1024px){.ff01d61571{height:var(--bui_spacing_3x)}.e0

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1002), with no line terminators
Category:	downloaded
Size (bytes):	1002
Entropy (8bit):	5.701644045708987
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEzn/PqjCC5zqinzYjnpRnLxR2+YI:YyLVkczEzAEzmYnbuO
MD5:	ECEE2E29DD00A24FB536CF681B6D2FE2
SHA1:	40BC0B3B8D7BC13A5A7186538737144E0B02AA5E
SHA-256:	A4BDCF773739389E5154C8E46A2EBEF93B1E618BE8E742CF6BB171B3AAE0E4BE
SHA-512:	A02B0637C37B484075F4D293BACF6620DA01C64D3C52F69B1CDCBE5FD8674A3E05E1255A1E691BB3687E27CE258FCEDE4F08EECF35928BFCF7E9108262FC61DA
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1705360597923&cv=11&fst=1705360597923&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}</script></body></htm

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	28618
Entropy (8bit):	7.993426317521322
Encrypted:	true
SSDEEP:	768:i7HOxn2ZkEzD0sMvSN2Nu54pTO/4NxYpadJke:uE2aEzMvw2Q4RO/KxYpadye
MD5:	C2F129CC95596EB8D50DD34DC095E5DE
SHA1:	2AAC01AA7330C66540917DA1B4F205251D3267F7
SHA-256:	8C8E5782453466A1B78C6391FBE45F6A5B5A74FBFC8795222833B6F9788AF4FB
SHA-512:	D0BCF395CEF092DCF452C870FE67E11F9B9AFC796CC7B2504AD3A0DFAF9C98EC16F222F4CB039410A782BFBAB4419054A7189D89ADBADB616CC7E513EC1A1D56
Malicious:	false
Reputation:	low
Preview:	RIFF.o..WEBPVP8 .o...........>m2.G.$"..U.`...em.9#w..-.A."IP. .N{F...x..".W.u.+..k.....o.?Z.O/y....?.~..q.ou.y./.f-.=\|.\|....._.g.....C.....{`.....z....Ww......?.y.}..g..f=.?\}:...9......?.......+........{[.....JH...n4..v..H."af...emv^~..:...._...)..QM:.ki........[.8~ZQ...&.t..N.../.px..)v.k.K.u....B\|.,.:.o'.y...m...0...nnr..)..q..;`.p...).t...J...46rPr..t..GpM.w.\@......h_...}..$......19..U........s....+s......4.P.>>0cUyT(..%........d.z..Yzl...o...O5.eO......~.R...>....t....N.}._.........^...W1Z..DB.XAbwj.Ta......).w?\......N..y.}3...Q.-....9.E.U;s..V......f.(..Ba0;......m5...:.\|h>....@c...T.z..........L2....hA.}p.6....Q.$.&.&1}.O.O.+."...fD&...1?..cn..\|c...^..n..t.....e.......B..!Q.)...&........N...F.PT....1..y......Q..gl..K.3..d.....g.....5....H..&......(Q..+............x'U.&..N./..GW_.$.,....]}..].)..T.S!........)...LQ\.K.hw.4.c...Z..MS.....0..j...v.\v.5...-\..$9Q..2{...tPq.3\|K../..t.{.....".].vO...h.=..&;..A.Q.......1 (.Mu...!.........i

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3448), with no line terminators
Category:	downloaded
Size (bytes):	3448
Entropy (8bit):	5.530693411500075
Encrypted:	false
SSDEEP:	96:jrD4sT8YpNJIG4QeSZK7qVwRDg9ZAfjxv4OVsBSnXHi9/D8a:j3jQigUjZK7qVwi9ZIjxv4OVsAXHW8a
MD5:	09A80A4A23BDC1DBA67F37FCA7AF6E1B
SHA1:	F37CD1B7B407485887C87717098A0FDA8FC268C6
SHA-256:	EB8A863847BBE73AED0FDFF596DD87C9CF66E85E4CE3526869D99FA9BDF01ACF
SHA-512:	47DA02BE31F6780E500F6B76D590401ADA521A011BA39BA7A262DF202221BD46FB08FFDD50742729A6A49A030BE020E31CEF09E197BE29FE073B8634449B7D2F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(_){return _};B.define("with-capla",function(_,i,e){_i_("edd:cabb24f6");var n=_("promise"),t={},r={};function d(_){return _i_("edd:4d350593"),_r_(_.slice(0,-8))}function a(i){return _i_("edd:dcecff49"),t[i]\|\|(t[i]=new n(function(_){_i_("edd:e000dba4"),r[i]=_,_r_()})),_r_({promise:t[i],resolve:r[i]})}window.B.__caplaInitialised&&Object.keys(window.B.__caplaInitialised).forEach(function(_){_i_("edd:1d620442"),a(d(_)).resolve(window.B.__caplaInitialised[_]),_r_()}),document.addEventListener("booking-capla-initialized",function(_){_i_("edd:bf4fa97b"),a(d(_.detail.namespace)).resolve(_.detail),_r_()}),e.exports=function(_,i,n){return _i_("edd:edf87387"),_r_(function(){_i_("edd:e42d11f1");var e=arguments;a("b-"+_+"-"+i).promise.then(function(_){_i_("edd:7774fbc2");var i=[].slice.call(e);i.unshift(_),n.apply(n,i),_r_()}),_r_()})},_r_()}),B.define("component/genius-vip/const",function(_,i,e){_i_("edd:9c374cd9");e.exports={CAMPAIGN:{SpendAndU

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360584011&cv=11&fst=1705360584011&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2323), with no line terminators
Category:	downloaded
Size (bytes):	2323
Entropy (8bit):	5.8847595970857105
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08NLUSRohtzYigl0c6:wsbSUtJfxrqLWWWdV6j1RLuTl
MD5:	D658ECD7DD2B867840C84886EFCF93FB
SHA1:	4A064B79C8582AD5A078DCF7C4EC465CFB6981E1
SHA-256:	2A3C45483836568B9F557C6C213C1A967AEEC45BF2B209BD7B3F33550B8C4DDB
SHA-512:	50060C570FB031AB47934DC19917A172867A2D3CE5BD2EC3C1560C421007EACDB0977DBE7E0966051A0987FDF53DD9E7831E9B8C823176BF81BEF4A59BAF9D92
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360598079&cv=11&fst=1705360598079&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	7.911129446769755
Encrypted:	false
SSDEEP:	96:ghIE2tGm4eGwtSB/zkLS0XcggJr+HvXr/hhGtcYZskvU:mIVtQeGw4lzWSQc3evXr/hwton
MD5:	F496F8B627C128FFADC8772E29C8D712
SHA1:	92D9EAFCE5AFFEF1158743BF1AC768703096CDC9
SHA-256:	9CD751C772BE140862566B72806AB9157C1AEAB1F02942EC4B2627995446DA6F
SHA-512:	6E33458F7ECDC24AE944CB7D7F9CB84F511A229E0103B6FBEFF3F629FB5874E28E9A26578137E56F2ACDA98C2D45A840CB50902CC6396C2AEB413F9E9E9BECED
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M4.M5...M4.M4.Fj6.MF..Dj&.MD..F..T.Q51..0..i..4.O4.T&0..<..1.4.Nc.....Ns........=(..M4P..dT..{o.....@.h....?.L..m7I.s.$.OR....R.S....E2d.....d...\w<:...EI.".....9.?_.Y;.<..j.w....{..?..U.3........f........}..?J.4.(S.....G.[.3..}.P.........=/S.At......o...+..Aw.h....hgD...;.y..(.../...7r8L..i.9Oi4.\.ZG.&/3.b.s..z.....#64.mC..L...$pJ.<..p?.C.b"j..V...DMQ1.Z

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2348)
Category:	downloaded
Size (bytes):	6105
Entropy (8bit):	5.437874807472625
Encrypted:	false
SSDEEP:	96:5NcjRhp0zrAPKI1xtOXVy6s9R4Y1CfPDqZaw2PMTBxj6kDxx1vnysfRjUlEYdO6s:5NcjR30zK3ws6s9R4YAfPDhNETflDBy2
MD5:	8E62FBC0AD68AF20BD820DED5B8DE62A
SHA1:	7EB712F30E1355CF59F28033C3F513EE0B5C8981
SHA-256:	367E9BA17BEE1E676E15D01DAA52D8FEC079988777F11440D25CF1710ECDA7EB
SHA-512:	9F3F76B22EC6C27AF29821A8DF0AE0009E63803E95EFF99D9A4E1047FD89A426899B147ACA03C1DBB18CDC529F3E74A31C1AE0B9E77F76E17CFFCD2064EB4827
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/pagead/js/car.js
Preview:	/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ .var f=this\|\|self,h=function(a,c){function b(){}b.prototype=c.prototype;a.D=c.prototype;a.prototype=new b;a.prototype.constructor=a;a.C=function(d,e,g){for(var y=Array(arguments.length-2),l=2;l<arguments.length;l++)y[l-2]=arguments[l];return c.prototype[e].apply(d,y)}},k=function(a){return a};/ . . SPDX-License-Identifier: Apache-2.0 .*/ .function m(a){return Object.isFrozen(a)&&Object.isFrozen(a.raw)}function n(a){return-1===a.toString().indexOf("`")}const p=n(a=>a``)\|\|n(a=>a`\0`)\|\|n(a=>a`\n`)\|\|n(a=>a`\u0000`),q=m``&&m`\0`&&m`\n`&&m`\u0000`;function r(a,c){if(Error.captureStackTrace)Error.captureStackTrace(this,r);else{const b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a));void 0!==c&&(this.cause=c)}h(r,Error);r.prototype.name="CustomError";function t(a,c){a=a.split("%s");let b="";const d=a.length-1;for(let e=0;e<d;e++)b+=a[e]+(e<c.length?c[e]:"%s");r.call(this,b+a[d])}h(t,r);t.protot

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=d7cca39c07340212&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	downloaded
Size (bytes):	1582
Entropy (8bit):	2.0935949490559387
Encrypted:	false
SSDEEP:	24:KqH7QNbKDCaVH//zkVKaklSvDBkNothKK1suC8GCODul:fsN+lH//a7iNsj1RGY
MD5:	FAEDFE66CF96784098C9B7B1F405EF12
SHA1:	645DCE7842FA7483BB676DEF6DF255317F203F22
SHA-256:	A87EC2239235E2521BEBE6F92DC4A65CA035FD419EBD09B68D04B989AFD3141A
SHA-512:	26EF8C32AA51607F3A2C8F517D3A7578FB5F5B6D623581D5BDDC54FC458658E7376263D8511147CFC7A3A507DC51E295382A1FFBDE510C59445E6911AAACD47C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/b25logo/favicon/ebc77706da3aae4aee7b05dadf182390f0d26d11.ico
Preview:	...... ..........6...........................(.......(... ...@................................5...M...jC..)...g..........................................................'w...............w....................................................................................................UUUUa...3.......UUUUU .330......UUUUUQ.330......UR.&UR.33 ......UR..UV..3.......UR..UT..........UT..UQ..........UUUUU`..........UUUUV...........UUUUU...........UR.EU`..........UR..Ua..........UR..U`..........UV.EUa..........UUUUU ..........UUUUV...........%UUU@.......................................................@...............q...............w..............wwt............'w................................................................................................................................(.......0........... ....................5...S...jD..>..........................................................w...............................................................UUT`.31.....UUUV.33....

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6954)
Category:	downloaded
Size (bytes):	227171
Entropy (8bit):	5.556784275285083
Encrypted:	false
SSDEEP:	6144:ORuvyMczItmYu0KC246zLVrktV9eUfR+U90l:daMczgvu0KC246zLVERx94
MD5:	F8EEB3F35049AC63CD1730A623CA300A
SHA1:	4EE9FCD33755600BF56CF0BBD7BB649A76212FE9
SHA-256:	CC7A1BE8E551A215E4F770D96BBA47C53BC470891B42B61D601B5508630CDE46
SHA-512:	1E856344119CD72A90D166E9758A49CEFCD24871FFD6B6EE11AD4D33299EC4D8237C3BDFDFB307C58DD0033005E35501073DF70F97DF4EC76B4009241658CD46
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-MRN9HVQ
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"19",. . "macros":[{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cc1"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"lang"},{"function":"__r"},{"function":"__u","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__smm","vtp_setDefaultValue":false,"vtp_input":["macro",1],"vtp_map":["list",["map","key","es","value","37900"],["map","key","fr","value","37352"],["map","key","de","value","37896"],["map","key","it","value","37892"],["map","key","us","value","37158"],["map","key","au","value","38363"],["map","key","uk","value","37899"]]},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"emailHash"},{"function":"__v"

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstB-sY_zJLWf-G1jdJEEbPMBA6HYna_ZDD0k5dB6e0QEWPLH1DbeAnOg4tTFEq2PGjxpkwigQI5FN79GLRfFZFHBYwxKAs74QC-SqIRzwTvXWBHmjzHOKg6iSqyrcBpOkcQOoPdkLb9sNgr8_wo6VHKV75K&sig=Cg0ArKJSzPD36WH-QkIYEAE&id=lidar2&mcvt=1014&p=786,81,950,1181&mtos=0,0,1014,1014,1014&tos=0,0,1014,0,0&v=20240110&bin=7&avms=nio&bs=0,0&mc=0.74&if=1&vu=1&app=0&itpl=7&adk=2692388390&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&vs=4&r=v&rst=1705360608278&rpt=1811&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5364
Entropy (8bit):	7.906665501686905
Encrypted:	false
SSDEEP:	96:ghIEhDH7a2DwHfLef7khjhS69A5zUGsw58RcmUSvE3WaLZwn:mIcDHWvjeEj45zxsivV3DLZw
MD5:	06BE00ECAED1E83D7B95EF8E24BDF64F
SHA1:	C07FDDDE0568E47193737A9CCF93E1338477D52E
SHA-256:	DB3E2202C7980ADD6476E2126A65D4460FB4ED5CD92D59DB603D4120EBDAEE9E
SHA-512:	392DEA2CEB22FCEE7D2448017DDD4B0E404C30B44EAD739EE388BEC4FE85D4AA520DAA7126D09E9F24130CA9384CF9DA5B27D15462D00B4660221A4BCB548AE1
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."... ..q...`o...t..O............z..i..Fcu.....CU..x....r........Ty...@..* ..\c.W...}4.u...Rb..Jb..B)...q.".......x..I.n(..Rb..1@Xf)1O.&)..b...(..9..FKyUm..@..#`......{V...mv.S..G.d#..=+....:.......%.}B....]c.8...R.)....~n...b.RL.....bI..>ea.H.......\ Y.v..q\]..*J.$..+.......Z....]J5`M..?!q...j....~.n...t.w.N.).F}...2.......K...l....z.Q\...qW....:.m..4RC..?.G

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	76617
Entropy (8bit):	5.617709084830567
Encrypted:	false
SSDEEP:	768:sV6yYelZ6jfU0E7eylJe8z+kjw0lIDGEZbgk2IXLxY7t9/ytTC9b0fAiKa9GKf8l:sUU7INHFGK9na3frQs
MD5:	545EDC0877E4AAB7611AAF9AEE2CB04C
SHA1:	3ACD5AD93526969D169354E55E7A34C6BE66AAF5
SHA-256:	8F43CD7A7F8FB1A9CC8100FE72D1F8A306F9B6C7AF8457A5000C249CB3257355
SHA-512:	D4DD2AED26C0387806A080F00A95389D1CE0F43D220C5F219C81F9FC2BD2100FDA299C95D36DD431947353766D1BF88002E26988C1C87D0E7C98DFB99AF3FA99
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=425093426163751&correlator=3649591904724868&eid=31079956%2C31080289%2C95320409%2C31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D7e7e2bed-860d-4ab7-afec-134d13ba8999%26affiliate_id%3D304142%26rendered_ad_pageview_id%3Df667a3ac68470510%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3Df927aa320290b431%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ&gpic=UID%3D00000db788c26b0e%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA&abxe=1&dt=1705360607284&lmt=1705360607&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360607&ga_hid=232771328&ga_fc=true&ga_cid=1111547412.1705360577&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360600687&idt=1331&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=2692388390&frm=20
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",1,null,null,1,0,0,0,0,"height",null,1,1,null,[138453373351],[6409064327],[5207250927],[3265750934],null,null,[764188],[12289587],null,null,null,0,null,null,null,null,null,null,"AOrYGsk21l6TBZfrmEwz3y5c1C9KkkGx23qEjeLZQzTfG_zNV8WagS8VuOYsc02tFyWmlXztwvLlSGHIe9SIXNsUSYT9DGTzLN-AJg","CK7-jKrD4IMDFbwHswAd704Knw",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qNzx-LrfMJntPtEix0FPWpWiScToXuYiwCGLvJnHekC4qW2D8h5mOZz4dneB4Nk_3w8edpy-XgN79JK5EdbP48X6Bhzt5dxoAmV2KmCcYk0-1lmupWU_dzxZYpGmomKXINJY04NF_wlyliwXWN-jJKJoMi9ilwfM-dBSZLz2woZ5QZ7SZ3O6I-3M9z5FnVksih-hZQLy3ogeIG_H7k-ilBqO-zpZpVC1s09gfKYK9W_vn_I47EE-uU21NEvEKlqIKpmXY2fALDiAYAiAmHNbpQU6pUU1cH9G8LO_cFITwB69TsrdaImg0TLM7Ljzx0uHhyPOQyfJ5A02c7qOsviDrNjlslJpTPH"]}.<!DOCTYPE html><html><head><meta name="viewport" content="initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><scrip

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (60582)
Category:	downloaded
Size (bytes):	105026
Entropy (8bit):	5.3035505683416595
Encrypted:	false
SSDEEP:	1536:+cmChHGIhtB++W2VuIKhGt3QyjI4qPCooCW5BxUPRXc1d4B8q+8OCfe1bdfUsoK2:+fa3QDUWXB8cWSHKq36cz
MD5:	1A16F971ED98C047C8FA288987383922
SHA1:	04200A6F3B25CDFA04551F635D025FC64743B4FF
SHA-256:	5AD7526D50B7586DDFAEE62B3FC95E71207136DC08F6A2B7FFD671DED73FAB83
SHA-512:	84E0B04C038B49972937E37F28923D11D988DC23B54BD836FEBF71F0CEFF251EDC01CA2DC441A1502E9D34BBB234E1733C27164E47DE98F9548B1563F55130AC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js
Preview:	/* @preserve. * jQuery JavaScript Library v1.11.3. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright 2005, 2014 jQuery Foundation, Inc. and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2015-04-28T16:19Z. */.!function(e,t){"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(h,e){var f=[],c=f.slice,g=f.concat,s=f.push,i=f.indexOf,n={},t=n.toString,m=n.hasOwnProperty,v={},r="1.11.3",C=function(e,t){return new C.fn.init(e,t)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,a=/^-ms-/,u=/-([\da-z])/gi,l=function(e,t){return t.toUpperCase()};function d(e){var t="length"in e&&e.length,n=C.type(e);if("function"===n\|\|C.isWindow(e))return!1;if(1===e.nodeType&&t)return!0;return"array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e}C.f

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21224)
Category:	downloaded
Size (bytes):	24203
Entropy (8bit):	5.349731623672621
Encrypted:	false
SSDEEP:	384:PLX1wtH+NTv0vDckjUhzU0ZppJeiUGg2TD7eC43YU/Us3ZYNbHG3W5AJdME9oPaV:jKtPQOaG3WFaoPaIK/zn
MD5:	F1DFC75C82E12DFE846D5593978E422A
SHA1:	12E580A708B09C9A8F4CA7CCBE9DD7DF32EDEE60
SHA-256:	08204982C484FAF6890C60557A4E642971F17625DDDDC0559DC0E3CA728AC9E0
SHA-512:	623412E6D454104251215E38A0F365F879EC70F77306769F5FA40E144C0EAB43237D1FE13B92031AD5848071A6A8910F01576F079E1A0904F4D8DD8959D922A5
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},ea=function(a){return a.raw=a},fa="function"==typeof Object.assign?Object.assign:function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(d)for(var e in d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};da("Object.assign",f

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	7.911129446769755
Encrypted:	false
SSDEEP:	96:ghIE2tGm4eGwtSB/zkLS0XcggJr+HvXr/hhGtcYZskvU:mIVtQeGw4lzWSQc3evXr/hwton
MD5:	F496F8B627C128FFADC8772E29C8D712
SHA1:	92D9EAFCE5AFFEF1158743BF1AC768703096CDC9
SHA-256:	9CD751C772BE140862566B72806AB9157C1AEAB1F02942EC4B2627995446DA6F
SHA-512:	6E33458F7ECDC24AE944CB7D7F9CB84F511A229E0103B6FBEFF3F629FB5874E28E9A26578137E56F2ACDA98C2D45A840CB50902CC6396C2AEB413F9E9E9BECED
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M4.M5...M4.M4.Fj6.MF..Dj&.MD..F..T.Q51..0..i..4.O4.T&0..<..1.4.Nc.....Ns........=(..M4P..dT..{o.....@.h....?.L..m7I.s.$.OR....R.S....E2d.....d...\w<:...EI.".....9.?_.Y;.<..j.w....{..?..U.3........f........}..?J.4.(S.....G.[.3..}.P.........=/S.At......o...+..Aw.h....hgD...;.y..(.../...7r8L..i.9Oi4.\.ZG.&/3.b.s..z.....#64.mC..L...$pJ.<..p?.C.b"j..V...DMQ1.Z

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360607937&cv=11&fst=1705360607937&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	downloaded
Size (bytes):	65913
Entropy (8bit):	7.971307226627467
Encrypted:	false
SSDEEP:	1536:9vW7pKpv94/eYULcKq1l4dZjq5PYQa6WveFzOy9yJ:9gpqLcQq9YQ9WvOOF
MD5:	C88841AB244771406A1E494DA906DF08
SHA1:	0EDCAA4C1AB9DB7288CC1C893B4672EFEADE4022
SHA-256:	74F172D0322ED8D5A426F2966E4A814D321837FFBE589EEE38FDA77292ECBBFB
SHA-512:	D44272998071A09FB9D04D4BB0B54E06EE60850901F2304209DB5BA0FDA7E5212572D5F52EF43E5ECEC6708013E45550C76CFEAFCB9BF0C7559904FD2826C66E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/600x600/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..1......%.P!(...J....J(...IKI@.4...@....4.i...4.Ji.SM.'.M..i..i).z.!.%)....IKIL..4....Jq....IJi).i..RP.i.8...m!..4.!..N...JJZJb...i........m.)qIL...R..6.\Rb.....(....IL..Jh..&))qA.......%!.SM.6..z5..lb..d*.F..v..,dn.......<._..j...~..K...}7.:....qR...Z;.0.y...o\|...N..k...[P.:t.~.j.8?}....}k.5..N...M.....J.A.....eY.@x......?S......);.ln_../.......W..s.

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=124265061.1705360598&sst.gcd=11l1l1l1l5&sst.tft=1705360596915&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=6130&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6611
Entropy (8bit):	4.802621919645174
Encrypted:	false
SSDEEP:	192:FkeF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3xp6Jco:jdwDHj4/2XH73uswpzowDH3xp6Jco
MD5:	46DBDB24D04CC095E8DBC711CD3A84AD
SHA1:	2F5A21C649B9462C59ECC13172E2DB34C61B0720
SHA-256:	E9891D135846092DF9E074774DF03A2DEBCDC5D51FBCA252F3468394CE7AB0F9
SHA-512:	62A132C4B8FA9BFB94AA4F1612D5389BDD8188A9EF5912C151CF3DD37B093FF6A8F572724641E6CE5497A7F83600EB3D5D1B874601D6B2C877F682E4CDADA2B3
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"501b35ec-1330-4a3f-9287-1f5f727b0f3d","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
URL:	"https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-jdMjjUwC227b84Dh6MIXwLUNPlK5A79RreLlwA&google_gid=CAESEA5KuMKjelDfqCe75gri3zM&google_cver=1&google_ula=913071,0"
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.149663203746594
Encrypted:	false
SSDEEP:	12:YNNGa0+CDlx2NB7NpJYeknz/isuKkJ/0PyUL3j:YNNGa1CqNB7NpJYeknz/irJ/0rj
MD5:	9AA0177FD051EED964F34A80F40052AC
SHA1:	52C90BCC3BC21E1D5ADD5A12484B25C491A0BDD2
SHA-256:	843DCCA5D1FBC3D8EB851FA2EAAA2F67F6A8B7E022EFC29D4468C1FD1886BEB6
SHA-512:	31B727BF8BD68D7D2A7D3CA407D148F340D06E4E86A607AACBFD741EDE4E325D340353C1C113CC1786E0DF74E48FE7F96D41CF90D9430EE806EC9896BD28D5C2
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,[["ID=df6c468a9a0b0042:T=1705360588:RT=1705360588:S=ALNI_MbF54Hu0MAe6djcI33DN9X4dd0B5A",1739056588,"/","booking.com",1],["UID=00000db78983dba5:T=1705360588:RT=1705360588:S=ALNI_MaoybMmrZZMfAn5Vlo71eYOux1bAw",1739056588,"/","booking.com",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CL7i1qDD4IMDFbXpKAUd214P-g",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPimdxO1v0rUN8wmlvlOauX7l4SqU6r9xPhTNPoPyW4I89iWW-bSKpmcsnUhGlIn_lIju4mUnu63Q"]}..

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	47044
Entropy (8bit):	7.996449359306395
Encrypted:	true
SSDEEP:	768:ezupOXz1dh2H4FaKt7EWvDAlro8OB+YhPblsoQeSAlff4KdFadZMIF/pztWvcW1+:oucu4JtIWmOBnhxsrulX4Kd0XH/VUvB4
MD5:	C41BD4232794517257342F91A8D7EFDA
SHA1:	91FFB521249382DB3765C12E16638B8789D3AD11
SHA-256:	631797E5D47F343739554BA3436A51D381F520C1D53C65783FD51D68D5904702
SHA-512:	4790DD51B0CCA1A08021DE90E4AE955EEFA976A59F0C1F998A92794B84D5C96487AE8DC928753287AC27404BEBE39CEFA29563C8DCBBE9F6B6EAE518CBA623C0
Malicious:	false
Reputation:	low
Preview:	RIFF....WEBPVP8 .....y...*....>m..F.#....=....cl..+..!.5....+.Hx^.i..JF..>.{..?..`.#......y.(.`...7.>?..........d........\|............;.W............?.}.2.......'....I....m}......?.^..q..o`...I.....^....\........._.m~..d.8.....q.e..e]DI.}...D.....bw.pq..gM6...).2Q.3kh.>.&<."g..F`.D..&..hW=..XB..p.O.A....G.{.g...f..6.I.W..O...x.~..Pp.\|.p..c..f..O.b...%U.}.;op..H..y.?..i..U.w.3y..THL-.....XX..G...`.....kN..M.M.9.(G..iV0...(\|8...c..)..,..`....kkh"...<...L;.+)W.}V.......s...<3....X..J........I...R....p.t....]........>..V.....Z....kq..-....^...a.(-r........5q;.xvE'$6.9..N.....}B.../.....g........v."_'..?....\|6.+..O,U...O...x.......(..q.}.d(.C.l...j......c...~.@....&....'\|Kjx.....m.3..8....O.'g...7t.Z....}.....5.5).s....2.n.d.._....\|.%3..P...;.....e....0....g.......,...W.3..8......_q?...E^.$.=..!.\^\..^$2.2R<....-...J...z....T.R...F.D..!.5.]....B...&s..."~...v.'1..W..6....v.......NEo....~.....W..]\].2.. =..!1\..4@.W.....v.:..e.]>...Ko..rG4@

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
URL:	https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-ym9jxUwC227b84Dh6MIXwLUNPlLW16HYBvcyug
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605681
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360598079&cv=11&fst=1705360598079&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360607901&cv=11&fst=1705360607901&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 912x472, components 3
Category:	dropped
Size (bytes):	80355
Entropy (8bit):	7.655557659776673
Encrypted:	false
SSDEEP:	1536:4gxrR5Xb4CNqFk2Wxjh6FSDMkMaBfxfOnakN5NbXS:4UrRZ0r8d/DPhBfxfyvxzS
MD5:	A53B29DB82BD58CDAFAB840D88D3CEAA
SHA1:	001F1C8675AFB0C0A5C30D6ADC22CD38473C0D96
SHA-256:	08C7078B8DF92B76EACE4002EF24A8221F7B0931B8E8542730C7722CF1982549
SHA-512:	7838572EF05FE35F8E3DD54D010DFAB47BB5CE42ED5E9F93733900F250C4ADA548DB51A75763BDC70F271EC173C944B8078A7BE79BF061562E876D24FF87D5C1
Malicious:	false
Reputation:	low
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 714 x 471, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	62401
Entropy (8bit):	7.9871887601831935
Encrypted:	false
SSDEEP:	1536:C4uYaTtopxISOKH2tdIdWqH9h2jXHMBfqXijncyCx4yzj+:CnzT2ISOK4dhqdh2LHCi4f2zzj+
MD5:	D8C78BB4AA47AB6AE3DF9D9E2FD9501E
SHA1:	8C959E1DA33C4EEE451EF13E2CD0F8B2327B7F76
SHA-256:	34643FF9CA4B3EA1209F72B31DFCF85C0D23A9D389766BD908EFF7A8DFD51F8A
SHA-512:	1FB28A2A22AFAAF382A0FF74339FD641A09E2C58B6BAB5B88C6EE7C447F1909502B952C3B86D7F9007F52400EDC205A187D23E74485885E246926E96B162D1E7
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png
Preview:	.PNG........IHDR..............6\|... .IDATx^..w..gy....<.O;S.Q.d..W$[...6......d.&. ....;}.Ih.%._.8........6.E.%..>..9.......<g4g..._/aI.z....s=.."""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""R\|.@DDDd.j..<i0...d.hs..%^.z...._......L..,""""2..e.....!((......AAYDDDDd..."""""CPP.................EDDDD...,""""2..e.....!...D..~..W..r.h...K5...y..EDDD&......>!.C.A~....P..`m..[..;0.`-X.@.k..O..-X.p8........}...Z{..\|....bPP.sb...FjIR..,.xWX......cs...O...`...g...Ms.o...0.....s.....nw...9..r.p.`9.f1)DDDD.@AYF.>RQG..v\.#.y.......;(......R.]j.}......s.c..}....71f.n..nJ4.3..%.......eD.5.4QK0p.x..I\g=fc.N.....wX....`....4^..<.e.....7a.M<C.....s....0...LMv#..\N...........3..ST.C......r;^...n3...Sf+....c:m.....((. ...x..f=.A`.4.8)....`;....I.}.y....w.....L....H.vB...C..*6.[6?.?6..P...b/.x..O..c.1....n.!..4"""23L.0$.f...S.o..?a.<...f.p-...r.9...l.O..g}.Yc........MAy..................,..2.]....I.\|...;n..".........IAy..OQK..ek./

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (836), with CRLF line terminators
Category:	downloaded
Size (bytes):	2103
Entropy (8bit):	5.673266977016779
Encrypted:	false
SSDEEP:	48:t+EYbPEGsAPi74j/iQNLIe+ymtt+GRaY9b33+Jv1F10:I9bPvnXNLh+yc+klb3OP0
MD5:	3C372EB7A1D3D58A1F8089C1E678E801
SHA1:	8BC293E17DCEEC77FFC0218D13EF7FA1B6072442
SHA-256:	665F9E050F804511D6844A82D8876CA6D61319BBDD04A5A25BADCB77D63D2B88
SHA-512:	0C70F949AC1D069E17541AE445F17CDBBBEAD3897AE60B53292D061DA17C5BE46EED2EAC2FC5D4D79F9BC7A606211DC64ADE14C895390A9FF281F6C20ACEC331
Malicious:	false
Reputation:	low
URL:	https://fledge.us.criteo.com/interest-group?data=WTN--XxscmpyMlFMTy9iZXFqVDhHdXBoKzQyT2ppK1J1N29kd09xaDY2TzZvREtJOVdFMzlYNDkvNExrYi9NR1ZsdDZRa3VmVG9yL1kwQWtadGI3Qm1hOEcrb1VGVHUyTmlpZkkySFdoSTdFWWJsNWljak96ZzZGYnMwbURiWDZ1VThzY3w
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. Chrome origin trial token -->.. <meta http-equiv="origin-trial" content="AnolOEEMEnMaCvmUcw/eijaA/Ntx4pke43TW8O1+XFxTL7yMSzmBnkPrjQ33sKmqvREEpLQOE72gUMzHLu9KiAoAAABseyJvcmlnaW4iOiJodHRwczovL2NyaXRlby5jb206NDQzIiwiZmVhdHVyZSI6IlByaXZhY3lTYW5kYm94QWRzQVBJcyIsImV4cGlyeSI6MTY5NTE2Nzk5OSwiaXNTdWJkb21haW4iOnRydWV9" >..</head>..<body>....<script>.. if (!navigator.joinAdInterestGroup) {.. console.log("No fledge for you!");.. } else {.. var igs = [{"owner":"https://fledge.us.criteo.com","name":"Jd9ftnxnYUVRSkNsL3BHWkRud2IvMjdvTjV3PT18","priorityVector":{"browserSignals.ageInMinutes":-1,"browserSignals.one":-86400},"biddingLogicURL":"https://fledge.us.criteo.com/simplebid?platform=us","biddingWasmHelperURL":"https://fledge.us.criteo.com/criteo.wasm","trustedBiddingSignalsURL":"https://fledge.us.criteo.com/getvalues","trustedBiddingSignalsKeys":["zOXyy3xscmpyMlFMTy9iZXFqVDhHdXBoKzQwaTdGeHZucVRSZDMzNWFaUmJJNmkweFBMTkFRQUZzb

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	31784
Entropy (8bit):	7.9948303468433854
Encrypted:	true
SSDEEP:	768:05xAOj6x2mpNztEaP9wVzjDsXyf5ZArMLWCddKVTWe2:05xAOj6x28J7+VzjD/ASW8XT
MD5:	F7D32E8ABCD959E1AF6E05F8D7A515B9
SHA1:	BC2DE937153625E6E5C76D720FCB512BF249D433
SHA-256:	02C9AD6D3A1C9456039B7DC5279EBBBF831E3FE3890D125C0D19A1E422F7ECC6
SHA-512:	22FF79E353E50295F5FEAB2E140FA104D74E87DAD20D47744A39DC6F0566E6DCEC988952570145BC67524E1C278DF71D05AB25C89197C957503F87CD7EFF2A35
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2373fb877f2b10681ae8abbb7a0c63613&o=
Preview:	RIFF \|..WEBPVP8 .\|...........>m2.G&$#!.V.P...cn...&C....O).....i9A..6.{.._.>5.......{'{O........q.p.z...\.Z...q.w.O=....q~......?....o.?..+.s._...<e......`.............7....`.w~../......\|..K...g...?......3...7.'...?.....yo..................Kk.Lw...f....f9I+..s......dk.(.&<.g,...k..Vh.....j.p.4.;....0....P...Tz.,..Z....\|.gP......"z~.W['yM@+.d......1.c}.....IE.9.d........<....q8..............D.\|o...N.....W.>}.......Q0i..-[.}.P...d.'.Ja..N. .....p.kz0. ..,...uM.V.[..=...;.....{....pUF....K......=oF..P.9....\....X.. .4N#U("l...x-..v.......~.Zc...j.S..T^..i.8.......<.?..#..O!W.......1F..E......V&a.2.z.S.I..O....=.]..u..x%j.(.G.e..Y"-S>....uK...`3p.bD..1a..OuQy.n.50."..i..h.).8....g4C.+...`.<Av^...e..*v.e....K.$..9m.,...K.I8d...5.h...b.w...4.W.Y...+..#+..uW.s..... \..[t...J...D.^.....yabF.G......L..Ity...G...'.......\|.z.5.n.M..zQ...F.X$P-...<.5.?.m...i...R..A...kz.....[:.]p.H.+]...[..&..e.j6.p....c.7..'........;..1B..R._Z...1...B...'S....<....

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31997)
Category:	downloaded
Size (bytes):	275294
Entropy (8bit):	5.791794100205205
Encrypted:	false
SSDEEP:	6144:zLbrEybJFmZ6ACcd5m3xWge8snrES8bdi:PEop+
MD5:	DC5BE92988D9CC83931C8660DC2A71C2
SHA1:	BDF6785153B8A8ADA1C0824EE13FE0A556953764
SHA-256:	0E3CD6436C3188852C7BC0A21B4C6789C22306FE5F5D64C1507D9F24590F7670
SHA-512:	7D2717B2175BCFB74E791491EE506737D153CC5E257D41DAB88C166114BB73EF984E8A772E7D8E03AE5CE609C48738A14912E4A800186133DAA4C64B0A7B3F88
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/libs/perimeterx/px.v7.5.3.min.js
Preview:	// @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed..try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.performance.now():Date.now()}function e(e){return e&&(pu+=t()-e,bu+=1),{total:pu,amount:bu}}function n(n){var r=t(),o=hu[n];if(o)a=o;else{for(var i=mu(n),c="d8jF4yC",a="",d=0;d<i.length;++d){var u=c.charCodeAt(d%7);a+=String.fromCharCode(u^i.charCodeAt(d))}hu[n]=a}return e(r),a}function r(t){var e=Ou[t];return e\|\|"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)}function o(t){return xu.lastIndex=0,'"'+(xu.test(t)?t.replace(xu,r):t)+'"'}function i(t){var e=void 0;switch(void 0===t?"undefined":Iu(t)){case wu:return"null";case Su:return String(t);case Au:var n=String(t);return"NaN"===n\|\|"Infinity"===n?Cu:n;case Tu:return o(t)}if(null===t\|\|t instanceof RegExp)return Cu;if(t instanceof Date)return['"',t.getFullYear(),"-",t.getMonth()+1,"-",t.g

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "main.43c0095c.js", last modified: Thu Jan 4 16:30:25 2024, from Unix, original size modulo 2^32 67325
Category:	downloaded
Size (bytes):	22258
Entropy (8bit):	7.991894308357658
Encrypted:	true
SSDEEP:	384:GnV3H0FDrJwctor0oKiFxYjkH+mbq+NtY46qsCcNr6B+bNQDi8Ghafb3eUcKX2l/:xBtaPYwHU46lCcNk+xQeidbkYYmE
MD5:	5E494B9F81F274670EF4976A71BEEDCB
SHA1:	9DDEF33D8CE2DE410FD5FAADA776CE9E28DAC418
SHA-256:	AD29AEEA39CDF06B410749F2D6260D0E61B86FB97F492BB78EEB5FDB1CE4FB3D
SHA-512:	CA258292334A47393D94005EE913F27776565B88F9054B6E1DF5372CF5CE459B23FBCAAF0B4BC176D209694B9AF16862E5BDB7894D60296C6622D408C5FE7F91
Malicious:	false
Reputation:	low
URL:	https://s.pinimg.com/ct/lib/main.43c0095c.js
Preview:	....!.e..main.43c0095c.js..\.s...2g..!...,;........&.$.....%.b+.>...g...v...%.v..ic. ..a.....`Y.HRn'..6.z.>l.....B5.i.D.q......../.C..w......&.D.>l.n....x....lw.[_g.n...s9!.u...i.f.9e.sA+d.^.t.0.K..\|.....p...g.d.......xq..r.B ..D.l...e.=.`.\.......a.....2]....P._D...U..5.~_...Xh....5....z.,...S(E....3Y.~_......f..}A.J....1>.R9.E.Tx....../.bBK(...X..R....w.M\.Z.b-.].....H...B.RN.ifK..%.....=.k.!..l..._H\.#...^.....2IaL1,f.....B.-...0...[ V..Q..U.....R....8.t.5.....H.Z...Ss..l.3...G.....U.d..Y}..m...)...7..G.....j..._N.uq....o._~..O.....\|4>.M.G.......q0.V..jf..@).D......].s..i...Y.8,n...l..8.....+...ui.......pq\|..../.$....fc.}a.)H.._ZA.P.......W......u..F...D-.1....H....".2o.$_....J...T\.k).~.L..Z............'..X'V...2.r......w]..%...z.....sg.8(.....WhR.^YR?..1yZ....RSl1.r....%....\5.(.....nA..../...I..[D.fc.DE..J...W....=..2.`.Ev.F.c...#].............+....v.7%.#....m.Pn.vd4....Qv..........>3*-.j..j.lV.yJ...f....;...hn.@V.U.......=...+.`)

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6613
Entropy (8bit):	4.8008586386275605
Encrypted:	false
SSDEEP:	192:FLF7pSdDHj34w8psdXH7uRCwpY6vepSdDH3oqjJcn:PdwDHj34/2XH7uswpzowDH3oqjJcn
MD5:	9BC67327163540F8BA264789217F9C55
SHA1:	F82EBA39A5169F873C6B4796BFA05CFEC5987974
SHA-256:	C6C4CAB9BF775042437310A3642624659B69FA5DA77FC743C4F7F224BBE7AEC7
SHA-512:	4DEAE57B3CE26CC3DE2C29BE5E580F199EE1BB5672634187EA6103326C2AA25426B4453DC1C21191B7648BC18D00D5DF7354DBC3385386A5A5704AD21844743A
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"04f32d9e-1729-4d42-82b5-91c2350ff323","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (565), with no line terminators
Category:	downloaded
Size (bytes):	565
Entropy (8bit):	5.013395369899308
Encrypted:	false
SSDEEP:	12:hR2zGkAIrR/+RRa2OXnlEceA9uJ33+SGf6bGEo3G1ONOI:hR26arh+R8xXeclk+h6vo2qOI
MD5:	433CBAC690542626F503B4269A8DA12A
SHA1:	3E810BC4ABACCF42AC5E4B0B939D63C03711BBD9
SHA-256:	F83B1A3EA61AD62E47FAD82DE5495A2547E2F12E591AD8108050538C566AE1E3
SHA-512:	569B3D704F2A979D16624064ABD3B97F38EEA3C9A5F3F09D31C9B83D62C360717F6F66EE44A6B53686760421A57D7EB4ABD54904556B105B05AA81D5850F34B9
Malicious:	false
Reputation:	low
URL:	https://ct.pinterest.com/ct.html
Preview:	<!DOCTYPE html><html lang="en"><head><title>Pinterest ct</title></head><body><div id="root"></div><script>window.addEventListener("message", (event) => {if (event.origin != "https://www.pinterest.com") {return;}try {if (event.data.key == "_epik_localstore") {window.localStorage.setItem(event.data.key, event.data.value);}} catch (error) {}}, false);window.addEventListener("load", (event) => {try {window.parent.postMessage({ key: "_epik_localstore", value: window.localStorage.getItem("_epik_localstore") }, "*")} catch (error) {}}, false);</script></body></html>

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	4615
Entropy (8bit):	7.887291203009579
Encrypted:	false
SSDEEP:	96:ghIEEnSeKY34LPYVtI3cD/Cps3rVl7vlbsLIsp6I3yRBXMBSdB:mIRSjC4jYVO3cD/Cp8rbJeIkyRBXMBSL
MD5:	EEC80925CB2599C34CE7C368DEF9EC9F
SHA1:	094AA6CEF6670AF0138A3BA97E67D95977E589FF
SHA-256:	5393D4458AA47507C1D1335A36934585FA44F0F92CC2F71627D359D727978793
SHA-512:	2B95B2434E2A92DEE4D01BC1D8FA1881AB0789C8F0F2CABF1037AE7020BD1FFFA60F20DA43857EA8A4FF6C673C5AFA2B67D50A9C4C446107A52C0B319FCCD4C5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...F.m.....+b...}..).,A...6.6.qX.e..m....!.F.m...;.....vR..b-.m....p...P...pZ.;....R..E..[(.Sm..J.b...`.m..a.h.Sm.m+..A...>.M.\\..)6U..l...A...>.6Qp.!.F.m.}...HvR.R..b..l..Q....e;eJ.......e..%8%+...e..g.......)vU..."..OSJ.h.U..A..Mrb1..o...........Q...et\..o.....e....(.Vv{Q..0X...eX.F...+..V6Q..a.g....jP.....=.vU.,.....+....t.]+...).q...J.b...=...j].\

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16656)
Category:	downloaded
Size (bytes):	16772
Entropy (8bit):	5.4055247071753305
Encrypted:	false
SSDEEP:	384:OZCz7jLjH5mIxmEP1haKJGs7hfinLVSTa5lX9:I8jH8toGs7hQVSTajN
MD5:	3D37765E3D72B91AC2FB047BA1E98C79
SHA1:	C0EF921E646A6941168995A3EE6D3A8EEFE535D0
SHA-256:	340797CB3AA3260E7E384442B4664DBBE173E8BDED084B49A447AC0E49B5B5CD
SHA-512:	D128D481B0140C666413817C672F90F6D7A2252C4BC328133B3E4735E7E6C90BFFE285DF377E7EDC2D4A37514B92947911602213C078CF66645401B66C7AC260
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.00d32fb1.client.js
Preview:	var bNativeDisplayAdsNdisplayAdComponent;!function(){"use strict";var e={"59b4ee06":function(e,n,t){var r={"./IndexPrimaryAd":function(){return t.e("18cad957").then((function(){return function(){return t("e2912eda")}}))},"./SearchResultsPropertyCardAdWithProps":function(){return t.e("acdccaac").then((function(){return function(){return t("ceccbee2")}}))}},o=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},c=function(e,n){if(t.S){var r="default",o=t.S[r];if(o&&o!==e)throw new Error("Container initialization failed as it has already been initialized with a different share scope");return t.S[r]=e,t.I(r,n)}};t.d(n,{get:function(){return o},init:function(){return c}})}},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var c=n[r]={id:r,loaded:!1,exports:{}};return e[r].call(c.exports,c,c.exports,t),c.loaded=!0,c.exports}t.m=e,t.c=n,Object.defineProperty(t,"miniCssF",{set

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2324), with no line terminators
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	5.894980523412902
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081kLmSvFhtzYiglS6:wsbSUtJfxrqLWWWdV6j1SLftK
MD5:	B761185AC85C5EDB697BE406B1BF5AD3
SHA1:	D1A366D57A31C0558F290B1130510942FCE8B149
SHA-256:	23667E7332199F7D97C6D17A201E920D276DB95B324EAFAE684970808426725D
SHA-512:	61227D957F86FA572CE44678C3D54D8E3CDCB3E41D3EA575969824BB0F87F054C9F3DD577959490DDE716C918AF30EA37353EEF9CEE9696D784DC2811A82127F
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360584036&cv=11&fst=1705360584036&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2324), with no line terminators
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	5.897020040467635
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081jLWSvFhtzYiglW3sI6:wsbSUtJfxrqLWWWdV6j1dLvtPa
MD5:	FDBABD7AA0F2F1CBC87D634F2191946E
SHA1:	D515ED68254DDBB5B949C54E650B71DFDB8EBC29
SHA-256:	0ED160E21EEE05E4F8D8967D6DBD235AC7A00FC1E58FE53063FC07B88D013C4E
SHA-512:	6E3B2FB3EBA5CDEDE887AC46AC9777A400FA305540AAD41CED2F36F4172A3823FF6FDBBD124D1936D9AAEADCB2B16C944E3F9111D17986A206BAC878B7F5B158
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360598042&cv=11&fst=1705360598042&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3004)
Category:	downloaded
Size (bytes):	210956
Entropy (8bit):	5.545292572767737
Encrypted:	false
SSDEEP:	6144:eRLxI5rLvXPp0yumb0fci6XaG2UuCmkZZd6x:fPuyumepia7UuCm0Sx
MD5:	D9A0D3C65EBECB879D587681E6EA89CF
SHA1:	BE78F08864CE1B923A30CDF6AAE900B7DAB80B1E
SHA-256:	82053B0EE9B4489AAEB10876EB9CBF5A581EFA099D73D0DCB69A568A4B5B91AC
SHA-512:	ACD8F524623F083AFD17538E69A7F2FBBB3A36F67918A53476779AFBBEB6DFC5ACA884E65D8118C522F0B9175A8ECF702CDEF7913665BB812969B0F49A4151F7
Malicious:	false
Reputation:	low
URL:	https://accounts.google.com/gsi/client
Preview:	"use strict";this.default_gsi=this.default_gsi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a1400, ]);.var aa,ba,ca,da,t,ea,fa,ha,ja;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};da=ca(this);t=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,val

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16222
Entropy (8bit):	6.016684630291472
Encrypted:	false
SSDEEP:	384:+YfWizq7xkjvuf8lLRl/hTlvzbnqv+mySv/JKeHIR:QimNuXl9l/hTgWmyw/wDR
MD5:	E6C8ADF228CEE04AFA5442CFA1985E90
SHA1:	14F00DD49CE4C1A45389971ED668CC7102DDCC18
SHA-256:	CF2144BC70967B7930F7CEF173FBD17AEBC11BAE70CD299F66703618945B9578
SHA-512:	A904A4624417724C445759F15772CAE86D7780D03E9EAEBC3B86B195D2AFAD9D6196B0553291613928995C302E49997FCC09BB238492EC5627648D2C0BF7CA90
Malicious:	false
Reputation:	low
Preview:	{"sodar_query_id":"67ylZemXEOXsxtYP_a2VyA4","injector_basename":"sodar2","bg_hash_basename":"MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8","bg_binary":"tYBfiPgxsRLlDy1ZAU8LdYtpwqgbDwFW3tuCv01+dIYqq5fgQsSXjSvYN/AQVptSdPvc/nUj7XmSx5pS2fOh3ZuoMormwaPgQZfDfHoRkhRz8ln5KPcl2I26DFS+rSOBjSk73hL2qc23IX8VeYRscGKuVLpjxY4f/usUt1r2JtOItewBphbZkzS3VOLz9PqFVeU/w6L0nxTVpBfApNpRCo451DeqwwFGnkQAvDLAVzpmb6LQL/tzAJYx6CGfxACGOVqTMbwA3wWGG2rzM121GdUGBXI+ccNnH8F4mwvbJF3u1Jfy/pzPUdORxAoHhUyb04WpUe7bRr6cAWUDzLDgmDlLRPuDbnReaCNnm4uqle/yh0CdM1LrNZW+3T652XX27FNFjdjdXm0U9QtgoP566H+tDlPN/+JbTmfoQmwihL+uzxB72LGKH+dm39tLDV5N7hFxMf1HFD9tCwA9HMJDTDoISHwtbBC3JRNClU/mbzlWCC+TnpKiFjnxYtuAQVLgCs24Bf+qeXqMwCfRuZhKt9MDnrnE5RMwZeOPq+LIadx11jlZbbUYUU17ELNl+v4zKNOUP8JP89rSsRpSSfvyAnE2nxJbDpv4tw5OBL77/fsAyRzpKlwqh+XMRjZm1EppyhEPtKwxR/xDAUb9xLfn4NDH0Jud1y27BBxFKefGfqncCyHyWoe/CccVk1Ykga2Q0ZkgONxFOQRauf/H8uHsffsC5BBdAzAgVh9TDxzEwkgTxS1KsOnhjXQ9e7UI7PdS9R8oNB63aQtx/PYNr4B/0bWDTjN30BhC8huPcvguHoqybTOd0vcuh/+tcMr4kA5H9B62919GntgIgsnIP

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2020)
Category:	downloaded
Size (bytes):	12817
Entropy (8bit):	5.34459161517544
Encrypted:	false
SSDEEP:	192:Gq6KPV24ZKs86O/DfVcOfFmI46coWCTGdhFKdbsWkzY:GkxI603wI46xWSGdhUr
MD5:	1D3D22DF067F5219073F9C0FABB74FDD
SHA1:	D5C226022639323D93946DF3571404116041E588
SHA-256:	55A119C0394F901A8A297E109C17B5E5402689708B999AB10691C16179F32A4A
SHA-512:	0B6B13B576E8CC05BD85B275631879875A5DBCB70FD78E6C93B259317ED6FD5D886F37D0CC6E099C3D3A8B66FEA2A4C2C631EB5548C1AB2CD7CB5FA4D41EA769
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Preview:	<!DOCTYPE html>.<meta charset=utf-8><script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function m(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");}var r=aa(this),u="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),v={},w={};function x(a,b){var d=w[b];if(null==d)return a[b];d=a[d];return void 0!==d?d:a[b]}.function y(a,b,d){if(b)a:{var e=a.split(".");a=1===e.length;var g=e[0],k;!a&&g in v?k=v:k=r;for(g=0;g<e.length-1;g++){var c=e[g];if(!(c in k))break a;k=k[c]}e=e[

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2324), with no line terminators
Category:	downloaded
Size (bytes):	2324
Entropy (8bit):	5.902182382953122
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08xAArNSatzYiglF6:wsbSUtJfxrqLWWWdV6j1aAfB
MD5:	29F306612039F30A2C453B496A36238B
SHA1:	CE50D538B658946EFCA6CE6B8D0F17A6E0C14FB9
SHA-256:	0630BEC148C2F8B2C3FD276B6983F2566645BFFA87CC2321ABA30A507EB9B1B1
SHA-512:	9B68B81D18E9DF022DF40B268DF8EA5BF1D9FAE8C5BD5D39E6F081C659E2214F1AFFDF420782ED2625FFCB60503015532DBF1EC2EC26D5345AE1C8927C3F959A
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360584011&cv=11&fst=1705360584011&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	62
Entropy (8bit):	3.9237100146972455
Encrypted:	false
SSDEEP:	3:CUHl/RPlr02mxhl/E5lmfpse:f9x0Rl/HBse
MD5:	3F386F5061436A0338A64E0910DB495D
SHA1:	599FE4A552C991A2B3CE5A1660732BF7B21FB901
SHA-256:	0AF3AAE90B7DE9FDCEEE2AB421378EA2F54C74BE81EF43FC6C1790A032755D80
SHA-512:	235479F42CBBE0A4B0100167FECE0D14C9B47D272B3BA8322BCFE8539F055BF31D500E7B2995CC968EBF73034E039F59C5F0F9410428663034BF119D74B5672C
Malicious:	false
Reputation:	low
URL:	https://tags.bluekai.com/site/29001/sync?3rdpartyuserid=Bx8UKBV0E95yOLdkbZHV5r_Piek0GO8a
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,...........L..;

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	dropped
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x500, components 3
Category:	dropped
Size (bytes):	45792
Entropy (8bit):	7.974352553118242
Encrypted:	false
SSDEEP:	768:FFevOGtlL7ksEysW87ScfhjFUe6maghjlsu+Ij+y2IX7Mfy17t6tiheoPB9zwQWU:FFg/tqsEysWBcPUtmaQlsuPj+VILwyR/
MD5:	0333C11DE7B88C4FD1D534D2C0BD59C4
SHA1:	C924AA1DF20B7E1EA8E642CFCACA476088B0EF9E
SHA-256:	5E9A16504FA6E4B9605B63B630CD686120A88BAAD5AB03A9F4BD788479F808B1
SHA-512:	39EBA832DCC54FB6E2629FA8F0F7D4D0CEF7D238BD7D5776141A25F1F6CD0AD2F20A76BD0C95B02EF3B0891B9099B55FDC07C20D69E5A09516B2D572C36D3253
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....K].lh7m....j.GZ..... 0,.... v.v...\......d..Y.z...p]T.T...V......u%.....:`..A$...Z......<..T. ..Z......B........;%.1..-.e.L..+4...]....X./.%\$k.s^..@..\|h...\...1...#.{t>...(...].i..bx.y...W....Z....k0.T5......._..F.t....U5.M..Gf^..>.jK....u....b..?.mx.........k.l.O.$T-.kbk...O...x.\|~g.3...d?.W.Y.<g..w.l....{..6I>.5.>#:...x..~'....\...j..G..O.m..R..[.

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6155), with no line terminators
Category:	downloaded
Size (bytes):	6155
Entropy (8bit):	5.322612950769379
Encrypted:	false
SSDEEP:	192:SeYjpkZzXkZMHISiYCNcgVRV5hmrHQVUm:AqroSRYHROKn
MD5:	1E32438142FCD82E3C2AEA1EC4900C2E
SHA1:	70F7F4732872C739C76969D77FE36D1D53333950
SHA-256:	C3F06CF6DED52069A79551343ACA5F2269A048CEDB9FBACD3CFFF7136980659C
SHA-512:	E390AF5B482CD7263CF2D3E00B001521F6E08936F8AAC0D0BC73BA8B092D96C82954C3E68F1F091214D6EBCB47B7D425F21B84A208572AD69EF0843AE049C6CD
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js
Preview:	!function(l,_,f){var s,u=[],o=!!g();function g(){var e;if(l.XMLHttpRequest)try{e=new l.XMLHttpRequest}catch(e){return!1}else for(var r=new Array("Msxml2.XMLHTTP.5.0","Msxml2.XMLHTTP.4.0","Msxml2.XMLHTTP.3.0","Msxml2.XMLHTTP","Microsoft.XMLHTTP"),t=0;t<r.length;t++)try{e=new ActiveXObject(r[t]);break}catch(e){return!1}return e}function p(e){return e}function b(e,r,t,n,o){var i;function a(){var e,r,t;try{for(e=0,r=arguments.length;e<r;e+=1)if(t=c(arguments[e]))return t}catch(e){}return s}function c(e){var r;try{r=e()}catch(e){r=s}return r}return i={function_offset:c(function(){var e=u.length;return 0<e?p(u[e-1]):s}),caller_offset:c(function(){var e=u.length;return 1<e?p(u[e-2]):s}),message:a(function(){return e},function(){return o.message}),file:a(function(){return"string"==typeof e.srcElement.src?e.srcElement.src:s},function(){return r},function(){return l.document.location.href.split("?")[0]}),line:t,column:n,stack:c(function(){return o.stack}),bot:c(function(){return booking_extra.b0

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	436675
Entropy (8bit):	5.3491438797198265
Encrypted:	false
SSDEEP:	6144:xQDr0bx2FTb4MT/XinkklO4E7q1uHBJUZ+jZQn54Nis:+sbx2FT8TE7qZZ+EWd
MD5:	5BC85A47C6673F1BEF3373BBED699DFE
SHA1:	2329667D5ED8323054AB72A5C2F9923002611AA1
SHA-256:	838F4B697DEEFB701F31EB892E6DDE74A92DD7C65D4D56F967BB79C17A66D79E
SHA-512:	4E187E5EB97D93D9877600B01A2FB59D77D5141D5DF986F074642A40E7708ABC602FCF17B343B5D0C8B07172F2ED955DAEE5BB196D32FE45D9D72B73CADDFEC7
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v202310.2.0. * by OneTrust LLC. * Copyright 2023 . */.!function(){"use strict";var D=function(e,t){return(D=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function N(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}D(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(fun

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	dropped
Size (bytes):	79443
Entropy (8bit):	7.971971192839842
Encrypted:	false
SSDEEP:	1536:9zgAaJHi3/iKOS+xvwbuo0ynQx4tkSVpDdQtbwccjJ2MiAo:tlYunOS8viDeCo
MD5:	63472F4041A4D95769A1031684B20A5B
SHA1:	0EC57B9113F5B91887B419A775F2BD7E18E5C7F4
SHA-256:	CFD7EED8654965FF34E4E1103D9D44A3F07BFCCCAF30AAC4661CF712CF7939EB
SHA-512:	C34CDE8D77CE3FAF88564EA673337607CE2FE785A63484302BD79428CEF55AB4F6F8A3FFC3139CDBB8FC77E824F5072446D44CCF83CC15F4F37C66A75E8A8E5C
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....(.....(...(...QE.........(...).QE..R.E.......(..0..(.h...)h.P.KE.......Z(...KIKH.......R..ZC.)E6.(.E- ..1E:.)h...R...J).(...- .....h..1..R...(...........).)..N..p...p....N.....)..p......).QE....h....J)h....(.QE..LR.E.&(.-......P.QKE ...Q@..R..E.P..Z(...)i.QE..QE.P..(........E....-%- ......R..ZCC.(.............R..p.....p........%(...QIJ).u(.....J).- .)i.-.(..h..C

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1082)
Category:	downloaded
Size (bytes):	1198
Entropy (8bit):	5.1778284266462595
Encrypted:	false
SSDEEP:	24:oWV/lweFZ3UYVN/QZSKGkMF6l4Q5fELnhtE1lvJHmqa:oatweFNUY//Qegl9FELnhtEfBHDa
MD5:	F820477C322829E348F318A453E432A5
SHA1:	0A19F5B0104161288CAACDC1F5CB65820BD49CE6
SHA-256:	F18F3B120659261F6C59D02ED462452AA29CB24ECCC1D0F894FF3342FFDDFB38
SHA-512:	016F2E1711174239943BE712E5FB304AECC4FF0570023EBCDC4C0EBA90D758CBCFE4A8DCD87407A126C778977B3BB91FD7B347D4606F66E70D1F430BCABB89DE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/53a8d0d3.b1818b84.chunk.css
Preview:	.a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin-top:var(--bui_spacing_2x);margin-bottom:0!important}.c3a4d3369f div{margin-bottom:var(--bui_spacing_half)}.fbbd4482e9{position:absolute;top:var(--bui_spacing_3x);left:var(--bui_spacing_3x);margin-right:var(--bui_spacing_3x)}.dd8e2ae84f{color:var(--bui_color_black)}.d1c3bff2b4{width:100%;height:100%}.ae2824c1f5{border:1px solid var(--bui_color_action_foreground);color:var(--bui_color_action_foreground);text-align:center}.dcc1c777cd{width:-moz-min-content;width:min-content}.a9e2165731{display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;overflow:hidden}.ed233f6bad{margin-bottom:var(--bui_spacing_8x)}.bca4b041e6{margin-bottom:var(--bui_spacing_4x);padding:var(--bui_spacing_4x);background-color:var(--bui_color_white)}.bca4

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2344
Entropy (8bit):	7.885895023441641
Encrypted:	false
SSDEEP:	48:5qdKL8E2+5H4aj+orbjgcF4cU7f/wEr7BObNyhtvqTRrfrz:h4EzN4aCSjjQf/1rdObzTJz
MD5:	D05A0AB9BF394439A1584A2B0D44DB5C
SHA1:	183C28023D3BA3358A7A5DF1DB887582AE5340ED
SHA-256:	B23272A9692C4EC3C020935917E9D096490876C976ABEC1290BD3CC9AAE13974
SHA-512:	1710604C6F6AB042DE505286DC4A6FA2217BF4126C000A510156E82BA975DEE0818E74DC612D556E76A71753B8285F759D4DB7566799FA72034A3E5EE5305482
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png
Preview:	.PNG........IHDR..._...............sRGB.........IDATh..X.l.......`.......K.'m...$...Ti.F..T.JK.4A."QZ...m......B.....B.....,...V....w68.......L.w>....>G.Pr#...{o..\|..{3.X.d..".E.CE.......J.Z.DH19[2nAi...;.X[..y....Q.?m..i...\|.d.N....RU..8.u..y...Ps..n'JE....d.w5..p.o.]..OWt.!..I.:j;....Fg:..+-c.j.6x.....s&........:jIu.'[.:...k?#.,.B.N[I....F.0.:d..e.-...`.GVT...:..,..)./"...8%34m.)c.w............J...ej.&>///....QXX.+((H....[.l.........y.P..z....M.3)b..r.}\.Zc.t.0..N.M1~..dJ..k:o..3AA.........X...........P..O.^ZZ:.q..M..,.0j'.#~..sn....m.++]..E..-..g/.....S..+....x....w\|0.#.....I)_.V..{zT..H...T..@9..b...(Ht...u...J.2...&...8...f...I76..<.....,.iT.c...?....%.....SJ....ZK@+..b)X^&....l.8...V.0]..0..A.3...q.w...r....._.(t...h.j...+.4.K.....4.....G.]I......JJJ.8..I).`._.D"'..`.....hnn....W....9.`)_..i.l..^....W.C.>...-.....i\|.R.....<{xx.....M4....F....#..-.@..h......G.F` .......\...?.1.....l.C[....s?A..?`\......n....G!./IkI.o..

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360583943&cv=11&fst=1705360583943&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	downloaded
Size (bytes):	79443
Entropy (8bit):	7.971971192839842
Encrypted:	false
SSDEEP:	1536:9zgAaJHi3/iKOS+xvwbuo0ynQx4tkSVpDdQtbwccjJ2MiAo:tlYunOS8viDeCo
MD5:	63472F4041A4D95769A1031684B20A5B
SHA1:	0EC57B9113F5B91887B419A775F2BD7E18E5C7F4
SHA-256:	CFD7EED8654965FF34E4E1103D9D44A3F07BFCCCAF30AAC4661CF712CF7939EB
SHA-512:	C34CDE8D77CE3FAF88564EA673337607CE2FE785A63484302BD79428CEF55AB4F6F8A3FFC3139CDBB8FC77E824F5072446D44CCF83CC15F4F37C66A75E8A8E5C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/600x600/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....(.....(...(...QE.........(...).QE..R.E.......(..0..(.h...)h.P.KE.......Z(...KIKH.......R..ZC.)E6.(.E- ..1E:.)h...R...J).(...- .....h..1..R...(...........).)..N..p...p....N.....)..p......).QE....h....J)h....(.QE..LR.E.&(.-......P.QKE ...Q@..R..E.P..Z(...)i.QE..QE.P..(........E....-%- ......R..ZCC.(.............R..p.....p........%(...QIJ).u(.....J).- .)i.-.(..h..C

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (26825)
Category:	downloaded
Size (bytes):	26942
Entropy (8bit):	5.166072324095411
Encrypted:	false
SSDEEP:	384:k9nMt16s9a18AUKfG8SEzVZRMZR0rsxsNZ17hwbGCy2mIAkAM:k9Mms9uIfMjMZR042Nj9Cy2mI5J
MD5:	56BE6F8CA27F57C0AE0F7DD1C1E6BAC9
SHA1:	D813B29EEC860BC574CEA77D6A9D22ADFBBC4737
SHA-256:	8B9C80636ED30FA4CB230B5D1ADC039E1C190E7F9002FC37E213177B8299F7FE
SHA-512:	87C197955F27D0CA264AC1189FAA653FB6B7EB5CC207366AE30C6B34759D9B5FD59772EB3A8A84B6291C6B14DAFF5EBCFDA519E02D3CCFAB8568F75B66A85FF7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/4dfc553b.202caa61.chunk.css
Preview:	@media (max-width:575px){.dc518186c8{padding:var(--bui_spacing_4x)}}@media (min-width:576px){.dc518186c8{padding:var(--bui_spacing_6x)}}.dc518186c8{border:1px solid var(--bui_color_border_alt)}.c3f3ac963f{background-color:var(--bui_color_brand_primary_background);color:var(--bui_color_on_brand_primary_background_dynamic)}.ead2dbad8f{min-width:var(--bui_spacing_12x);min-height:40px}.aa356a17e8{min-height:40px}.b526c59ef9>nav>ol{min-height:25px;padding-bottom:var(--bui_spacing_4x)}.b526c59ef9>nav>ol>li:last-child a{color:var(--bui_color_foreground)!important}.aceb494517{display:flex;flex-direction:column;align-items:center;text-align:center}.ae33dc1742{margin-top:var(--bui_spacing_4x)}.e2fa2a6076{margin-top:var(--bui_spacing_4x)}.a31a6887ba{display:flex;align-items:center;justify-content:center;padding-top:var(--bui_spacing_8x)}.c83fd4f5e0{padding:0}.d7f3f7f66d{position:relative}.f5672575c1{padding:var(--bui_spacing_2x);border-radius:50%;box-sizing:border-box}.fac6168b3f{background-color

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 100, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	73
Entropy (8bit):	4.6459447725206005
Encrypted:	false
SSDEEP:	3:yionv//thPlEbttZoGjxd35+kx/bp:6v/lhPG0GjL1pp
MD5:	FF823944BC0BB9E4BF87F0AD14F687D1
SHA1:	4B68BA281B9AB171611569BF78971DF6970EFBC1
SHA-256:	6153929734EC12EC07072F327C1112301828497E4DD356CA261461B0B7BA9621
SHA-512:	1338ED16F60A4C9BCFE69AF5713F86D231995637D83D9628368DDC97CBE034A95645B5FBD29DA886738D70656485D37CA0042AA2D03657DB96007114C0AD2D3D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/nobg_all_blue_iq/b700d9e3067c1186a3364012df4fe1c48ae6da44.png
Preview:	.PNG........IHDR.......d......N.7....IDATx.c`0..<x.....FQ8.P.....IEND.B`.

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	621029
Entropy (8bit):	5.515995337175916
Encrypted:	false
SSDEEP:	6144:kivQ1VrwNwh2JQB4PTl0kDc9C1LOpYADQTV4wNwh2JQB4PVxNgSUttGls3Eul5eM:BQZQFxNgreAQCQIPA0TgSl5dVmgjvxH
MD5:	3A5094AD3864E2147BDDB05ECA0E04DC
SHA1:	93C30C0D71F5288A413B52AF75A39E50422B5CF6
SHA-256:	62E782627287817FDC848A0946C282383DFB97F00888AD3DFF6DD92D657D021B
SHA-512:	4AF46A5FDFB9289A11B56B7111807ED173D573501156292BA394DBC40A7A576AE47D0EFD0B04255F6A9A5D0A2CE099E74E1ED3775B0A47F51C4BDBD49AA6A3A4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas_cst={loaded:!0,run:!1}),booking.jstmpl("atlas_iw_default",function(){_i_("373:2f8c4dd8");var i=['\n<div class="iw-container iw-default iw-','">\n <h3>\n ',"\n ","\n <span>","</span>\n ","\n </h3>\n</div>\n"],t=["b_basic_type","b_name","b_text"];return _r_(function(e){_i_("373:2f1cf5f9");var n="",_=this.fn;return n+=[i[0],_.MC(t[0]),i[1],_.MC(t[1]),i[2]].join(""),_.MD(t[2])&&(n+=[i[3],_.MC(t[2]),i[4]].join("")),n+=i[5],_r_(n)})}()),booking.jstmpl("atlas_iw_landmark",function(){_i_("373:8f20cd9b");var r=['\n <div class="mini ufi-label__container" data-marker-id="','">\n ','\n <div class="ufi-label__image-container">\n <div class="ufi-label__image" style="background: url(',') center center; background-size: cover;"></div>\n </div>\n ','\n <div class="ufi

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1182)
Category:	downloaded
Size (bytes):	1298
Entropy (8bit):	5.192772061822323
Encrypted:	false
SSDEEP:	24:iEf5WDQALreRUPbZdrS9ZV/Zc/U4V41NdqxHU:iA5qQALPo63GPkx0
MD5:	FDB620D16DDCB3D874C0D96880365B4D
SHA1:	D95824D3B336670E2057A5B35B60D0FDB3A7ED2A
SHA-256:	4BCB7F636B154F714E61CB33C7904BE7684225B53149144F21D8E98EDE64BF84
SHA-512:	D1659BC4BEB1CCEAE42D326D39A41C9039D9271011F661D4275782A6FE1A0B369A68AFFB9BF818D80A30E73536B514BAC2CF4C06F70B6C44DBDB211DA68D278A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.css
Preview:	.e3e54067e8{position:relative;background-color:var(--bui_color_brand_genius_primary_background);color:var(--bui_color_foreground_inverted);padding-right:calc(151px - var(--bui_spacing_8x))}.e3e54067e8:before{content:"";position:absolute;top:0;left:0;z-index:0;width:100%;height:100%;background-image:url(../../static/media/baloons.79c0e51c.png);background-repeat:no-repeat;background-position:100% 0;background-size:contain}.e9d8cf9c55{margin-top:var(--bui_spacing_2x)}.e461545713{position:absolute;right:var(--bui_spacing_4x);bottom:var(--bui_spacing_4x)}.e945244cd4{background:url(../../static/media/world-map.7d457a5d.png) 100% 0 no-repeat;grid-column-gap:var(--bui_spacing_4x);padding:var(--bui_spacing_6x);grid-template-columns:160px auto;grid-template-rows:2fr auto;justify-items:stretch;align-items:stretch;display:grid;grid-template-areas:"image text" "image buttons"}.a7d8e8e811{max-width:442px;grid-area:text}.fed256e553{margin:0 0 -14px;grid-area:image;height:160px;width:160px}.b3b0631318

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6611
Entropy (8bit):	4.802621919645174
Encrypted:	false
SSDEEP:	192:FkeF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3xp6Jco:jdwDHj4/2XH73uswpzowDH3xp6Jco
MD5:	46DBDB24D04CC095E8DBC711CD3A84AD
SHA1:	2F5A21C649B9462C59ECC13172E2DB34C61B0720
SHA-256:	E9891D135846092DF9E074774DF03A2DEBCDC5D51FBCA252F3468394CE7AB0F9
SHA-512:	62A132C4B8FA9BFB94AA4F1612D5389BDD8188A9EF5912C151CF3DD37B093FF6A8F572724641E6CE5497A7F83600EB3D5D1B874601D6B2C877F682E4CDADA2B3
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/501b35ec-1330-4a3f-9287-1f5f727b0f3d.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"501b35ec-1330-4a3f-9287-1f5f727b0f3d","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14844)
Category:	downloaded
Size (bytes):	14956
Entropy (8bit):	5.361035168061864
Encrypted:	false
SSDEEP:	384:yUMsx5wyfqcADWffBalE60NDaE/vkVQQZxWjgRALXZe:TM+fVADWffBalE6gD9vkV/WjgRALX4
MD5:	3DEA702266BC3A577D7141F2E79259DB
SHA1:	849AC9CD7737C5ABE6B4ADEA85011077E28B6C48
SHA-256:	E365A4FA6B7F7551601CBDB8D8EBD57CFFE18E9F62B50E8BA700DB9676004CE3
SHA-512:	A0CBEA68349AE121C0372F709B2070FEFD2D576AEA1B8C2AD34C1C702AE4EEEC348B7994A02E1A74D8C90EAC293E45A647807B28DCEB78C4533D8588658AF70A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/7bcb015e.c05167ae.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7bcb015e"],{af1e2b38:function(e,n,t){t.d(n,{Z:function(){return i}});var a=t("6ee88c54"),r=t("dc6d28ff");const i=()=>{const e=(0,r.getRequestContext)().getSiteType()??a.N.WWW;return{isWWW:e===a.N.WWW,isMDOT:e===a.N.MDOT,isTDOT:e===a.N.TDOT}}},"261e3243":function(e,n,t){t.r(n),t.d(n,{default:function(){return K}});var a=t("ead71eb0"),r=t.n(a),i=t("af1e2b38"),s=t("dee2534d"),o=t("dc6d28ff"),c=t("d1e54a96"),l=t("975f4b85"),d=t("41c6c66e"),m=t("cedcabf9");const _={},u={kind:"Document",definitions:[{kind:"OperationDefinition",operation:"query",name:{kind:"Name",value:"GeniusGuestData"},variableDefinitions:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"geniusGuestData"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"userInfo"},arguments:[],dir

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5857), with no line terminators
Category:	downloaded
Size (bytes):	5857
Entropy (8bit):	5.125510725698501
Encrypted:	false
SSDEEP:	48:0MdZqrfXXm+RQCZ6+NJCY2mj3lHKcHlo/8b6wEMnDZ2lM78jC+xjwpC22g+lqvcQ:/s1KxG3dPNTLnDslfjCYrovqvC9VX9Pp
MD5:	A4366E88E8DA37CCDD93FBC69D96CA40
SHA1:	1D6F1210C02174543F9AA8E4144A2C2505A87AD8
SHA-256:	6C27EFEC9580672C7D2AC20FD2CA63538474A3D2C4BF7694AE88BE7F957EAD3B
SHA-512:	125A0597984A694213937775CB08F65AC756CF571A1ACD19F18601ACBBEDA2259B7114BB9FC7B776DB77C678E54F677B39F71BD7CEC82314608D8F2109EFB127
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/pega_cloudfront_sd.iq_ltr/ac86554e5c372cd426f5393c7c95eea660624945.css
Preview:	#OnlineHelp,#ServiceCaseGadget,#ChatWrapper{position:fixed;right:-900px;height:550px;top:50%;margin:-275px 0;width:450px;overflow:auto;z-index:2147483644;background:#fff;border:1px solid white;border-radius:4px;-webkit-box-shadow:0 0 14px rgba(0,0,0,.4);box-shadow:0 0 14px rgba(0,0,0,.4)}#OnlineHelp,#ChatWrapper,#ServiceCaseGadget,#ChatFooter{-webkit-transition:all .5s ease-in-out;transition:all .5s ease-in-out}#OnlineHelp.expanded,#ServiceCaseGadget.expanded,#ChatWrapper.expanded{height:850px;top:50%;margin:-425px 0!important}#OnlineHelp.compacted,#ServiceCaseGadget.compacted,#ChatWrapper.compacted{height:450px}#OnlineHelp.minimized,#ServiceCaseGadget.minimized,#ChatWrapper.minimized,#ChatFooter.minimized{right:-900px}#OnlineHelp.alerting,#ServiceCaseGadget.alerting{right:2px;margin:-275px 0;top:50%}#ChatWrapper{height:550px;right:2px;display:none;overflow:hidden}#ServiceCaseGadget{height:550px;right:2px;display:none}.chatLauncher{display:none}#LocalChatHeader{height:50px;display:-web

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 540x405, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	31670
Entropy (8bit):	7.993502656068093
Encrypted:	true
SSDEEP:	768:ZSmnJsWOUrP5k1P7ebijYQyA4BQ4fdC0kQlN8+bYdaGq:ZSmJkUFwjebwyAuQmdZkQokY4D
MD5:	F2C1E7AD49112E82ED4C1F57AB490C01
SHA1:	C34472438A3DAFCEFA5D4759C448BFD09F07DB34
SHA-256:	03116424B4CBAA9472E20A36A16BEA8EFD876F460356C7D7E86894E89414CD17
SHA-512:	D2C55BAC905806E21F47907CE1A04916F5EA80375DE8A43033E5FE02F26AE825ED818BBE4AE3F00553CFFAAB176EDEA2D49BF471D29970E73EDB01B1010E4E06
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22ddb81a8d5ed73135330e426f8d2b9629&o=
Preview:	RIFF.{..WEBPVP8 .{...........>m0.G&$"....x...c..j.$.....6].x.X...u.............}w~..q.................?.....$...O.G..s.....?2...9.)..._...=..3......;..<..O._.}B\|.....>._..#u............d..y.....0.4.?.....41I.>.a..a..a..a..a.....At..d...h...1.g.....;......0]O..6....wL?..i5../.Au.&........F.FAnD.......[ .a%/..J..g..C.+_......R....=.o....q.E..Q...........U.lA. .6..9...>.}...%....`(k@.WeQ...(.CR!.X..p+...M..CN[.R..s..?r.r.D.pF..=.... .............WL_..`I......9._.il...).........!........\j....w..d..?G..".....%z+....Q.fk.$XX.5..D.....@N.O...'......`...F..A.Kdl.sa,..4]<....J.;N...PE......D..]..P.J...B.1...g78...1.d.....v..AG.=.~..3....z..q...4.NL. .f...x.(.....G...d-j.<....R.e[R..9..x....C.?..:.w.b.....j..Yv.5.2-.. ....Z.Z.b..qc.1.......}...pA. ...\|....H,..TZ^..~\|.N@..B.g.h?t1....2^.......^.o......T.......;?..6.W(RD&....W...\|....Q.jj....9.}.O<h]x..+.Y-.......B.E.....@s`.^PH. !.."R...}....`v<.iT.:...tt.....><DW...E.}..s...j.0#........R.K3.O,...a

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	130895
Entropy (8bit):	5.52790581106513
Encrypted:	false
SSDEEP:	1536:P0c3FDB/Sj1Qp2wu40IDBgjBgp2dmhyLFHsp+bYe:jbSZQp251oqHsp+bYe
MD5:	8D340C5F9230BE5B10B1F59D2A17B65B
SHA1:	990F50CF5DC41D983F6B630CC3377DE7BD5F25F5
SHA-256:	AD5C1077EC4B41F0440C861998C3E52702F09BE7371113044C19F30E2C3DA943
SHA-512:	2D77CFB584AA5E19FE4806E17E89745E8D9A872A677EA444576B4463DAE206F411E566F50B99695F98EFFBEBBF457F1801B14C37E6FD7FDA5A3D69FDAFBF0CCB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js
Preview:	/! For license information please see 3d066b0d.fd7d6ddf.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["3d066b0d"],{d7745882:function(e,n,i){"use strict";i.d(n,{Z:function(){return c}});var t=i("ead71eb0"),a=i.n(t);const r=e=>!!e&&(Array.isArray(e)?e.length>0:"object"!==typeof e\|\|null===e\|\|Object.keys(e).length>0),d=e=>e.every((e=>r(e)));function l(e){return"renderIf"in e}function o(e){return"doNotRenderIf"in e}var c=function(e){if(function(e){return"renderIfNonEmpty"in e}(e)&&r(e.renderIfNonEmpty))return e.renderNonEmpty(e.renderIfNonEmpty);if(function(e){return"renderIfAllNonEmpty"in e}(e)&&Array.isArray(e.renderIfAllNonEmpty)&&d(e.renderIfAllNonEmpty))return e.renderAllNonEmpty(...e.renderIfAllNonEmpty);if(l(e)\|\|o(e)){return l(e)&&!e.renderIf\|\|o(e)&&!!e.doNotRenderIf?null:a().createElement(t.Fragment,null,e.children)}return null}},b6ea4fe7:function(e,n,i){"use strict";i.d(n,{Z:function()

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360584036&cv=11&fst=1705360584036&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2542), with no line terminators
Category:	downloaded
Size (bytes):	2542
Entropy (8bit):	5.958716421237317
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08r24AZNSVH/KMtktzYiglV7:wsbSUtJfxrqLWWWdV6j1NAOHyMI34
MD5:	B69262F87CE26922DD977FC6E498B6CB
SHA1:	E408FE34CEC8C2B92A3ECB2E78F79E768994F3BD
SHA-256:	DE15D3F21F8C0B2FB79F86CE6C7B9215DB3B80E9285698A7A9E6217355EA7D4D
SHA-512:	B237879A86C3870E204C0EF16760275CF65561D231861F92F3E892A05AA558D25C2BBFBC90FFA56F6DE1B2419D7447E04D1EBBB636000D1F8AC3945CB49A2B55
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360607901&cv=11&fst=1705360607901&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.262101507126395
Encrypted:	false
SSDEEP:	6:w9NARNMJjQykRp6bXN25xBRZVXokLVEXNBezVL1Eh4pIoauwUyBTyCc:qARsYUzN25HRZVXokSXNBezd1HIoauwU
MD5:	9F40753F88D4E54C57BB481A34826A8C
SHA1:	F67607F5FF0309AD4E3588CEEC60A6AB2A6C99C7
SHA-256:	C0E9F0C0559B4666C7145DD7022401D104C78E0FD23B9CA672963EA3D5286248
SHA-512:	7D970AC4BFB02DC1DD6E77219FE976A4AD9EBBF2A90270BC713DFB6A0AD565CF510041C7FA5F1176B31549F9F78D29EAB412C9A5DDD9C9F0D55C1E855504B37A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/7a53cdfb.d6ed6882.chunk.css
Preview:	.fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-line}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/7a53cdfb.d6ed6882.chunk.css.map/

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1878
Entropy (8bit):	7.7719881409378715
Encrypted:	false
SSDEEP:	48:HTD+qk2/6k9aPZbvzIT5nJOgZOZvXa3elULkw4t7:HTDtk2SKQq5nqZi54t7
MD5:	05C42F2F2CC422FEB81862208C26899F
SHA1:	0D7952B00E0716A3F0649D49BA8A4DD17403DE9C
SHA-256:	3E95390F09D7FE928C6784D3C89CFBD030241188CE2D9E9F9D658ADAD337B47C
SHA-512:	A452EE142FE9EE289446BA363D6F401887C728D26AB1304324170D5ABCE0066EE3570963686E0CC218D93741D6969EB46ECDF6DD5610B13F59D8D8943377B6DF
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BasicSetupEmptyState.png
Preview:	.PNG........IHDR...x...x.............PLTELiq..............X...........X[?@.....W..W..X..Y..W........W..W..X.....................................X............................t.3k..9..W.."........l.....9Q.....H\|...Oe.Rm.....'.....tRNS.ct.1....E.B.Z..y...+..]...1..M......pHYs.................IDATx...r.:......vpK9.............D13w&.....7k...B.....XF....Ikv...W\`.(.I....._v.......2_...k......v.n0...h...i..'.. ...P.a..._lT..M..YB0.-]5...T.z.b.e...4[z..[..F.M.F..m...n..}Z.~.....f.J..#......Y...O..8&.P...Y$...2a@U.q.`..".g..m..{:.XSfm..4R....k......V}...x...3.......g.C^.%..x..i.~.t....W..x.t`b...5.l:^d.K....3..Xd....]..........py+.224.\|O.#.j..^j..]..T`.qN.l.."..E....#22.4.WT..=3....43^..}u9..x..xaBs......h..K..>. ..Y(f./.........p.!.6,Pn.Y.^.....Lf..$aV..gV..U....f.x......Yj..f.x}v..\|.E...)......`.3.%....Y.^.g.Y%:.l~.3....$.{4,l='9...W#b.k=._9......i6.R6.r.w.&j..X..R..Y:....n.]..........hx.-7_.v..^m]..)7....^...xMxv.(mWqxu./{..8t..__.U.^...'.k6..]R..

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2309), with no line terminators
Category:	downloaded
Size (bytes):	2309
Entropy (8bit):	5.8839425932392375
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08y5dE8AASwetzYiglM6:wsbSUtJfxrqLWWWdV6j1AdERFE
MD5:	5242EBE7D12551EDBB1E613E33B2384E
SHA1:	853BA2DC1C00BD643D914566BC965D7DCABF6742
SHA-256:	646A9A4A97BF32D7920553E710F3CE2A7A44F9A4657BD5505AF258F623C87964
SHA-512:	CF3FA1B8E7FC89B7457DE5917D6E6D232663F275B95C92AC95B280911FF67E0A86279ABD3765308236FD2E63AB8F157C1B7F96AB210437D6F7A8488E49BC5E13
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1705360583484&cv=11&fst=1705360583484&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053606001
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 92724, version 1.0
Category:	downloaded
Size (bytes):	92724
Entropy (8bit):	7.997553923653277
Encrypted:	true
SSDEEP:	1536:teR2vJkIpD1ojHcPqWmz/EPCGYPvI9iZ5zwgksuLhEjYfy3Na7SQs0eYMgUxQ4W8:iCJkKpogSRz/EPmI9S5zwgkd9EjWYNau
MD5:	F132633E65809EC36C0F01B8A29FA457
SHA1:	E68A5B0DE3E08AC85A13426CE3D8C13AD21D38FF
SHA-256:	A98C20990FE3E31203FE2DB8384AF8E05E7B358CDAE3C28B034E1F02B47DB630
SHA-512:	7F2AA9B95B95F93565DEEE578BF01C57A6D0A28DDE40A202DB6E4EB7554A5076E5C86FE9DED23E56F1BB4BA2B42EBC9AB44B03AE5EFB73E81A6EE077CC61D9E6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2
Preview:	wOF2......j4......%...i.........................?FFTM..Z. ....`..v.....L..i.....6.$.... ..{.._[.~r.bp..%t...bj.../..&q.._.!w.b...y...~.d....I#........j..IlqJ.Tj+..cB....eV...B.#\..g.M...7.;......\|.U........6.-.....6..U9......G....A].b..w....pV...rr!......p.V.....8.../?YC."A...-\NSQ..0.,..H<6.Y..Q{..U..r k..0agr)..o.g....f.h.V2.Wp.#..vd.7....O.s8.U....Sic..N&........b..........&I..@..Tl.5c.."..i.e.=...=...J6T.+~g.x/:..~...{`...Z...m..X...v..jW..e..U......{W8J.B.z.Q..K9.....V..b+.....Xz4.v4...&...4......... .....h.....I..1@D...{FN.=.7{..t...Rg/.!~...P@E..m.(.D{....5.T.@{..U....J.g.u.......u.s.......$p....?......d..F.....+....'!<.......I.B.Er.,S90.]..].O...O.h......Y`.m..<..s.TC.V....c.......!v....$G....j.S.{R%..;...u...{..&..-...0......\|.sj.x..,[2$......\|....:..i..y^.L.!$...?2.Ao<f.f..G....s?d..ZQqy8...&.G.P.!.^]...G5{.g;T.pA.......8.....@.....M9.ao.._....!....T..M.*K.U..wl......C....DE.D...T.Q36P.j...r...2PQt..XI.,6.Z......rs..9

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1705360597783&cv=11&fst=1705360597783&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (829), with no line terminators
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	5.40532098153805
Encrypted:	false
SSDEEP:	24:4Hksf5VRq5/Jz2pRNrBZJuvu8goqc0ioNhc+y4+mI:2Rez2bNrVENtmN+e+j
MD5:	65855829A0B7BE954B8250FFF9268AA5
SHA1:	700A775DFA33AFF61217853E9A6541AF46208B9B
SHA-256:	963F4ED910EBB9A23C1AF7B84E4123036ECFC910FB4A4BA64D2EAF38AA6C837F
SHA-512:	19E269E53FA195DE9A6DE32EAB6196A8FEF594255256593B7C0ED639B7F82B68A0D4505AB44F0CC82E8F67603FDD260B0410ED06608B9B88D17EDA7CCB3381D5
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/aframe
Preview:	<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="B1IkrhrF_dHvhI3G5g9Azw">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha / try{var clients={'sodar':'https://pagead2.googlesyndication.com/pagead/sodar?'};window.addEventListener("message",function(a){try{if(a.source===window.parent){var b=JSON.parse(a.data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorage.getItem("rc::e")\|\|0)+1);localStorage.setItem("rc::h",'1705360588446');}}}catch(b){}});window.parent.postMessage("_grecaptcha_ready", "");}catch(b){}</script></body></html>

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5364
Entropy (8bit):	7.906665501686905
Encrypted:	false
SSDEEP:	96:ghIEhDH7a2DwHfLef7khjhS69A5zUGsw58RcmUSvE3WaLZwn:mIcDHWvjeEj45zxsivV3DLZw
MD5:	06BE00ECAED1E83D7B95EF8E24BDF64F
SHA1:	C07FDDDE0568E47193737A9CCF93E1338477D52E
SHA-256:	DB3E2202C7980ADD6476E2126A65D4460FB4ED5CD92D59DB603D4120EBDAEE9E
SHA-512:	392DEA2CEB22FCEE7D2448017DDD4B0E404C30B44EAD739EE388BEC4FE85D4AA520DAA7126D09E9F24130CA9384CF9DA5B27D15462D00B4660221A4BCB548AE1
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."... ..q...`o...t..O............z..i..Fcu.....CU..x....r........Ty...@..* ..\c.W...}4.u...Rb..Jb..B)...q.".......x..I.n(..Rb..1@Xf)1O.&)..b...(..9..FKyUm..@..#`......{V...mv.S..G.d#..=+....:.......%.}B....]c.8...R.)....~n...b.RL.....bI..>ea.H.......\ Y.v..q\]..*J.$..+.......Z....]J5`M..?!q...j....~.n...t.w.N.).F}...2.......K...l....z.Q\...qW....:.m..4RC..?.G

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3385)
Category:	downloaded
Size (bytes):	209810
Entropy (8bit):	5.400755454017142
Encrypted:	false
SSDEEP:	3072:j/2dbK89R6x4DFpAjJrOrJrpKazavcslvXc5e+okilMo/GtALq:L2VP6KkJUdpKEavfKe+okilMAGtAO
MD5:	66E1394C6D18F34245D87144B9193055
SHA1:	A93C71AF5BE58C82693690E58E7411CD7B4D2E2F
SHA-256:	ED88D5A1C97DC43C114C0B289B3B5ABF077BE44E8E8765A9AD777F94AF433411
SHA-512:	FD3F6B472CA12DE8BB35F67E7B7F38A11A47ECE02206C74646AA0D1D5F56E91BB1A36735047E67DD0995DAC2F35FA4A3018719BB460C45A2C3B020EBD0092335
Malicious:	false
Reputation:	low
URL:	https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Preview:	(function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),p=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.p("Symbol",function(a){if(a)return a;var b=function(f,g){this.Jg=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.Jg};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 72, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.69670577809709
Encrypted:	false
SSDEEP:	24:ahvlk2c/6qz+2SDaUGyHHT+hYuwNdfCIaKFIxp8c1wolBTaGIx:Uvm2c/6gSDbHCWNdqIaKFIAc1D2fx
MD5:	025B409525836B9E0913038B2556D2CF
SHA1:	187B28FAD3A710B3712B56E53BE8FC4E142D9ABC
SHA-256:	BF146C2FCD8C33FDEA4570ACC5F92BC73B337B1EFBBB2C318089F7BEA5396672
SHA-512:	5B7A5EF3A3A941A92D33FF9713AAFEEBB0CD21E3E84332DDEE259562D33AEFDB36644A99F316A3627AFEC1ED9E51D1B0E3E47B846DE487A393EC768A63C150CE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H...H.....b3Cu...TPLTE./].w\|.hm>Pw...!7c....=D.QXVIi+?iix....Yh.J\.5Hpz...............21Y.}...bg.....^u....pHYs.................IDATx..V.r. ......>7....).........}.Z............[.......B.G.@$z"......JH7..{...&..G....LVu~N.U."S.~K.F..B./..mYP.%..&`...B..:.It..]..4.....L...oIb.-U.B..c]Vu..Y.iy(.g.7...L.j...RC.!6...-..+..........D.3r./VB.7?'#}5s2..n..0Q.T?./....B2..nFr.........g,..."G..HlFm.....&..&.......{M`>.L..6=hn.O..p..h..:W...B...M.D.u.X....B.,e-Y...7..={..i...SwL.&..:..1......Xpidl..3.r.R....l.".FQ.^.t%.....q.eQ.sRv."..........5....a.....{.Z.....fX.-.35.{.p..c+.).F(P.9PN..!...Y..x....<Y.=.....{..1...r3*..#........Q..83.r-XM...6.f.6C+:.d....9.9.?.._...D.3.#....).F..... F..f.@...N..:O.....h}.0c.q/..'.Bh.b.B.%...p...#.r-....#.D<.Go.1..g.y$..f.N..r.3.......j....9.#yt...k..4..$hA9..Z..H...i....B??._{.....:.\|..p......_.P...B...........=_.P...B............x.....r=.!e....IEND.B`.

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19849)
Category:	downloaded
Size (bytes):	19965
Entropy (8bit):	5.4268945066358505
Encrypted:	false
SSDEEP:	384:T71nbvjHUAW0VunhHnMsCh2LhwfxdOX2F48:VnbvjHUfeonChg6JdOX2z
MD5:	D78C34E2DBEC204465921F484C1997F8
SHA1:	B6B0D1AE5DF66C0637284827222B757ADB98C237
SHA-256:	07B50AC877934B1CE0BD68C040F83BAE04EFB2DB4E19B60681CDF4F367DCB2E0
SHA-512:	9E1D015154B7361482C5B22B35B1123A63911A45C241872DD637DBDEA2861ED3B8D89ABE0995B3B14125097FD666D769D300BB169919258001A412773F5BE781
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.f0866eea.client.js
Preview:	var bWebcorePersonalisationComponentService;!function(){"use strict";var e={cc4c374e:function(e,n,t){var r={"./HomesGuestsLoveCarousel":function(){return t.e("bf9eb7a3").then((function(){return function(){return t("300e7fdc")}}))},"./RecentlyViewedPropertiesCarousel":function(){return t.e("e661b1b4").then((function(){return function(){return t("e3a9785f")}}))},"./SampleComponent":function(){return t.e("702a7b0b").then((function(){return function(){return t("b2dbdbc7")}}))},"./SimilarPropertiesCarousel":function(){return t.e("a4087d56").then((function(){return function(){return t("d9a597c0")}}))},"./UniqueStaysProperties":function(){return t.e("6289254d").then((function(){return function(){return t("088f7f58")}}))}},c=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},o=function(e,n){if(t.S){var r="default",c=t.S[r];if(c&&c!==e)throw new Error("Container initialization failed as

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56559)
Category:	downloaded
Size (bytes):	56671
Entropy (8bit):	5.488435594454668
Encrypted:	false
SSDEEP:	768:nzwlVMng3E0L3pCMCtCmCMCtCJ+lOZ79GB+XNotgDh6XxXLY1AAKh/iTlLiC:z4E0LUBgjBgXZ6+KWDkLViTlZ
MD5:	1843F2502E83CFA4869676007B653C89
SHA1:	9028E89318E7CD6698D66FB89904B73F557BBF75
SHA-256:	0E01E63D4B63CE52F3FE93CAC7FF74A5E02BFA02BEFAFA0B657B60B7B0C479D7
SHA-512:	79C6E83357D80EC59CED73BE01EE6BCBF75005962D0A88383FDEC4B44E07A978D6970BFBE82E171E3AFFA15C8C61CA8DD581AEE1FFAE1857E93B102CB105628D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/b9a82cb8.4f94b8d4.chunk.js
Preview:	"use strict";(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b9a82cb8"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInternalUser()},get isLanding(){return e.isLanding()},get isNormalRequest(){retu

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1385)
Category:	downloaded
Size (bytes):	1501
Entropy (8bit):	5.294345318137106
Encrypted:	false
SSDEEP:	24:pCeRnGqc9jYhfZqQ+P9sKggminjsle03mHNrVtqk:we5Gbkhf8v9nQmtRUk
MD5:	2980EA90C3F4C27D77BFFBD1527870A7
SHA1:	539A5FDC38B2EAAF9118BCF337C55353FBE35E18
SHA-256:	97473C5D5A46930143691CDA2D7E112551C0AD7EDA321BC5120B80F429F7D3AD
SHA-512:	F91017973B160039D6E494DC1D42AD24A0848D0317FC10E3F113B5E3D60C0236F91F0DC0AB666938FAFCC3113EE7B83F87AE76D1327548742B344D02120B206F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css
Preview:	.f395e522bd{width:100%;height:100%;display:flex;flex-direction:row}.fb0e8491f2{margin-block-end:var(--bui_spacing_4x)}.af0c2122fa{margin:var(--bui_spacing_4x) 0}.d412802652{height:100%;width:100%;position:relative;border:1px solid var(--bui_color_white);border-radius:var(--bui_border_radius_200);overflow:hidden;display:flex}.d412802652:not(:last-child){margin-right:var(--bui_spacing_4x)}.d412802652:hover{border:1px solid var(--bui_color_brand_genius_secondary_foreground);cursor:pointer}.d65598d5f9{width:100%;padding:var(--bui_spacing_6x) var(--bui_spacing_4x) var(--bui_spacing_6x);top:0;left:0;margin-bottom:var(--bui_spacing_3x);position:absolute;z-index:2;color:var(--bui_color_white);text-shadow:1px 1px 1px var(--bui_color_black);background:linear-gradient(180deg,rgba(0,27,65,.65) 0,rgba(0,27,65,0));filter:progid:DXImageTransform.Microsoft.gradient(startColorstr="#00224F",endColorstr="#00001e47",GradientType=0);box-sizing:border-box}.d412802652:hover .d65598d5f9{background:linear-grad

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2146
Entropy (8bit):	7.8875883951747925
Encrypted:	false
SSDEEP:	48:j/6u3CtuLhUGh0H5UFe2pYo37Esd2gjEj7seiEfE/ODAtLx:jSRuLKA0ZUFnR4sPEUeJf8/
MD5:	27E71A5124018E16EAE0B8897618623D
SHA1:	D0D54D88B04EDFC71F338C19EAB9994632BC6CED
SHA-256:	1D6E86E59AB7235A8343F494C8E8DA6CC02C5A98A75D682401340E6D06935F20
SHA-512:	A9D6F6B881175780E2619843AA88AACE7E94DA178C53C3DDDE691A930C5412FC4CD817009D488757835903D9218758F808AC36C1F828371D57AF91EA9CF3170A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png
Preview:	.PNG........IHDR...F..........b.....pHYs.................sRGB.........gAMA......a.....IDATx..Y.pT..>...........e....f.+(T.L..KiZ.....`..c;v .....u.M...h.........DJ..RQ..-?!FlB.}..~w./........3s..}..s.{...et.Kyy.....;v.....N..p.....I4=...t..'.BI.,/X..R.0.%.<.....F...i.6..rSJ.......Mgy0x.#.:....YYY....}.....~..L..M...........d.`..t...>Gi.K......)W.x.i?.5H.........Q...-0z..8 ?..IR.G`..N..`p...Q<.t.i2..~)K.G..l\y(4E..y.31.7.(....Wa..>......_RR....6.-..7...Iy..y;......~.<..T....)k.e...D.f...........2.k..0.=.[..D..n...W..V.B..uVUU..."5m.0W._.0a..^.'...V8x.. e.I...H8..... ..N;....".&.J...Hd.l).81....5.c...<.....W.o....U/(..,.O..+.c.ZZZ........L..c...V..[...... .g(.Y..P....>.>.-v?....>..&.?j.A....)5Q...KO....'.l..G...:.b{..#..4.`.[.]..V..20.k.-W.<.m[.q.BA.i........!...,.6.....N...l2.......`......1...o^...iY.]...&.O....\.c.>L.w...:.......u..d9.f.Ld.*....J...=...1....A.!&.c......f.}s....,."..e.....2....)...%..o..I\."_JL..id..c.N.y...k...p.m..A...

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1606 x 765, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	210892
Entropy (8bit):	7.962502599388432
Encrypted:	false
SSDEEP:	6144:SgmNfvaEICxTKCqMXKGY2ayHLkYEUc3ydOOfr:SJBvfACqMqlwnNaq
MD5:	DE106B424D9C3E736045CF5E397011E7
SHA1:	730776156E4FB71E40D2E334FA1764233CD6D5EB
SHA-256:	4106B2D21AB42C4365272BDEE58A096FB6E6EDA00A15EF9C8B5BFB593C5E3595
SHA-512:	DADCE234F2F89C3D8B9F44E14FE9CBC410567E621026249FA55998793E230388FC6D2C173B58997076C7F39BEE120C9A355A92690837ED6F4DD3B8C7DC0678F5
Malicious:	false
Reputation:	low
URL:	https://q.bstatic.com/static/img/join/world-map-gray.png
Preview:	.PNG........IHDR...F.........~..X....sRGB.......@.IDATx..[.,.y..8.....v...X;B.3B".w\|..#..H.$.].J.[X2W...W..)H..p..02..S..{.L......k..{.8.3...4S.U........5.F....#`....0.K#0.......d.....a........~+.....[..~....o......8W.....^.....>..#`....0.F....#`....0..E....\..0.F....#`.6...I.....x..7[7o....l....;.N..........>y....B.......www.\|.\|e.B...^qxxX.....;w......?....7..>. .D.R..d.J..L.v.I........0.F....#`....0.F..l....l.+u....0.F.....@]B...%F.e.@....^{.%.FC.........+..%....o..o..{.p.....B.\..Yp.....o.eM......7...pN.../..... .-.P.!...%.).c..`....8.V..w.....#`....0.F....#`.... p.....=1.F.....F`\|..g.?...i6..W...>........nH..%....w.......A.b]..\B.\_..oGB..V.:...........!..~....Z.k}d.....4.A....NV.q.0..!k..P.l.6@...0.F....#`....0.F..l....B[.1w....#`.6..4.i.......1.M.(K..........i..'?....Q.3.<S..?.C0.s.R.......K8....o.\L5$.h....k..eGv]..V!.5..a...X..g..h ...vd.W.AH.<..,.....T.{...WZ..InO.xL.r..........:.$.\|)..=...........W.wW..@x.y(..0.F....#`....0.F...

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36716), with no line terminators
Category:	downloaded
Size (bytes):	36716
Entropy (8bit):	5.219455971257271
Encrypted:	false
SSDEEP:	768:gT7Evz5Cj857THYp8+32gNz/tefjJaqlSCVDdYCQCrwLchrOhwNZJEJRGVuaFKef:p/kef5FNdtLL
MD5:	83450205FDAE53D35568C0B20EBD7823
SHA1:	B767E5626F5C78A36E8267ADCE0EB4770CC7AF54
SHA-256:	0916F90FFE5B1EB07948B9F85568C812D3CCBB8A05D3B39D10F4D59FCC9E168D
SHA-512:	A5534E8E888C92ACBB5FD97909DA22CD1ADC08F43226482C37DE7880942F1E64C5E9420307E2D2F63073747D8BCCA3BD13A516A3CE2FA40311F59CD571A585F7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};!function(i){"use strict";_i_("039b:c970d6c8"),"function"==typeof define&&define.amd?define(["jquery"],i):"undefined"!=typeof exports?module.exports=i(require("jquery")):i(jQuery),_r_()}(function(l){"use strict";_i_("039b:06d74a49");var r=window.Slick\|\|{};(r=function(){_i_("039b:1a9b8522");var r=0;return _r_(function(i,e){_i_("039b:aa04535a");var t,o,s,n=this;if(n.defaults={accessibility:!0,adaptiveHeight:!1,appendArrows:l(i),appendDots:l(i),arrows:!0,asNavFor:null,prevArrow:'<button type="button" data-role="none" class="slick-prev" aria-label="previous">Previous</button>',nextArrow:'<button type="button" data-role="none" class="slick-next" aria-label="next">Next</button>',autoplay:!1,autoplaySpeed:3e3,centerMode:!1,centerPadding:"50px",cssEase:"ease",customPaging:function(i,e){return _i_("039b:47add93f"),_r_('<button type="button" data-role="none">'+(e+1)+"</button>")},dots:!1,dotsClass:"slick-dots",draggable:!0,easing

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1705360607644&cv=11&fst=1705360607644&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x599, components 3
Category:	downloaded
Size (bytes):	128831
Entropy (8bit):	7.967166295665466
Encrypted:	false
SSDEEP:	3072:0MhzfsYRYyfKZJ9gKjPQiU8IGGlFQTnX/6q0USxgI:02zfsifKZJNjGGGoL/ZSxR
MD5:	F7DEF7C2BA05497217EE6B1EDB6F3BA6
SHA1:	E9810E9FCC346908E60DDE9893D7AA08E637DF32
SHA-256:	ED0B282849CE2B31404CF908328A2E5DD353DD9D53D86598524CEF4556C6C6E8
SHA-512:	B1CD5CDBC66F4776EB6CD94D98F61120F2813FD7C84A7AEE40E8958FFA4D3BF44B9865E0135A7E9678401D614BDEE6CC7906903C3942C6B2AE5A3714944383E8
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/simgad/1245127421624033504?
Preview:	......JFIF.....`.`.....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......W. .."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....V..jx.-.y.$...q..?~@.....%.yB...=T..........1....q.r..$..u.(W.[.....&.$+!....H._..<[....J..2.....i+:...~.......S..O...8...[=8...Z.z.=..Q% ..W..H.a...........\|.z....U..Q.g=..[..Q.xEC....L.1;K......061..J9.........x.Zp.cMn.:U...?.......?.J.R=:..:`}.......@...h......J.1............h<... ....'F...&q..4...>.(..........z...+{}s...A..J.g........m

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.873235826376328
Encrypted:	false
SSDEEP:	3:YA8rQaC:YAoQaC
MD5:	5FC018D9E6C56911BBC8DC5DDCD0C768
SHA1:	70979F57A85D527ED8ABCBF02CFF44640C58BDE6
SHA-256:	2E6D78A4AE644F3B60AFD3C33E66539FF6C5F6A8ED6ABC40A3AF06AC020EC020
SHA-512:	1E3B86274B3590E28366F2D2DE86A1844058E213BD225AAA05D992CA70523F65D2BD543F9F762A805A2C4D5961AA34F5A19EBE70E135939C9CD3C63F6B5F5524
Malicious:	false
Reputation:	low
Preview:	{"error":"Method Not Allowed"}.

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25190)
Category:	downloaded
Size (bytes):	42390
Entropy (8bit):	5.508489032246762
Encrypted:	false
SSDEEP:	768:J+i/6VUbdYCemxJzl516Uk2a++IhJ8aq9EpTEDGOzGx3vcMaG:JMVUpemfz16U7a9Iz8spTPOax3UMl
MD5:	E7E49FE6C519EFCD2B1E0EC1E46FB402
SHA1:	24228143FEC83DAEB8B6275CAF9A66D2089F09EA
SHA-256:	E5FDB3EA4CC4CF6B0F77FCE3B54D03D78A697BEC33BB1A023B964E8BE16AEA5F
SHA-512:	56D723428B584CB41DDF20BAD5B14C5CBB5EB42C746E2D5B4A8A1F0ED5674463C10E42A5EC59F32A2B10693C7D201F2C045C1AA2C87391520EF85249E951753F
Malicious:	false
Reputation:	low
URL:	https://sc-static.net/scevent.min.js
Preview:	/** Snapchat Pixel SDK */.!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,arguments)};function t(n,t,r,e){return new(r\|\|(r=Promise))((function(i,o){function a(n){try{u(e.next(n))}catch(n){o(n)}}function c(n){try{u(e.throw(n))}catch(n){o(n)}}function u(n){var t;n.done?i(n.value):(t=n.value,t instanceof r?t:new r((function(n){n(t)}))).then(a,c)}u((e=e.apply(n,t\|\|[])).next())}))}function r(n,t){var r,e,i,o,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return this}),o;function c(c){return function(u){return function(c){if(r)throw new TypeError("Generator is already executing.");for(;o&&(o=0,c[0]&&(a=0)),a;)try{if(r=1,e&&(i=2&c[0]?e.return:c[0]?e.throw\|\|((i=e.return)&&i.call(e),0):e.nex

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 112 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	917
Entropy (8bit):	7.637544373113396
Encrypted:	false
SSDEEP:	24:rwbsAiaE/6xi/NTzTZ4hxG7Bxqls6/kFy:rw7hE/6xi1fMUQmQ8y
MD5:	1DC79937E26730D866E5F2BB75B34417
SHA1:	5A3864F0338A83A7E689C0B062B9640BC0ABD914
SHA-256:	BDC9FA6B8E3557B42768FD4A878F1467974C0BCDDF9BFD14CF4AC1F351C3B02E
SHA-512:	25CE20E72D008EDA7A485CFEA1666DE6D3471D87C3D4C095648AD319D7B6F46499D10B34C4028EF85F24224F632DCBA4B32386D5592AA15BFFF702C63FFEB473
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Websites.png
Preview:	.PNG........IHDR...p...x......m.....cPLTELiq..U..T..U.....U..U..U.....U..T.........i.........U.........Xv...............&....r4Q.....gS.S....tRNS.4....w.K\...M.q.kL....pHYs.................IDATx.... .@..0...3f.......&hH..fS..%>p./R..,K$...)..r1%@........\.6:Vp...h.......t..X....J,....,..Yx..I'&.8..sZ_.d.....C'G..I.l.0..b\1.g(....k7.B......\|.....i-".t.E......{4.&d]. 3`Y>.(...y.%k.%.J....._...gvn.a&....J.o.q.y......M...P......g..X..@a,_..&\'a0.)..M.[.u.S>..p........qN..%,.6..)./.4.Zk.........cl5T...\|^..<,...d. .>-..>2k....>,.V.P.........%...W.p$..[.8D.pJ.zJ....h.n..3......q...Cg4.&..6...Y",me....r.y...t..HX.c.v.W..a..R..4..R!.....,.BF.4.V...{5./....E....^..kj.B..3.._*4..n....G).'......p.....9[T....F.$.../ei....!.PA.o.....0.o./..y{...1N.WW...W.w.p..v. o.{.\|.>u..<...e.tC4ln...57}.....x..5q..x...x..I.$8..?A".Z\|.....b....R..T.....L.M1...fM5..A8..H$.G..>....t......IEND.B`.

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20728&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=b4835f3e-f59e-4a99-a3c2-6f7565a3736a&ts=1705360586267&v=3.8.0-2401042024
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	185
Entropy (8bit):	5.154929849976132
Encrypted:	false
SSDEEP:	3:qQgfjg5anvEVUxQRJzRguRsXETPXIN1f4NoWjUHWnJzWLKjUSHJb4CNw1B:qQQjgYkeEJ9uUgL4xjJULA1Hx4CNw1B
MD5:	0DC8D88A3CFF3ACDE64D73D10AA73427
SHA1:	80E75C40947B9537ADC2F5C529CB076438898E11
SHA-256:	79C7B759A9C487AE1D5ED46CC67CFE9937DEA03770AC25379DDAE8F433A43E3F
SHA-512:	A3D4A446D5EAAE4043490677116824D0F3C85138AC1596F65FC0C7D101FDD6D30CDC9F018D2294F44022A5A3C26C066BFE7A170546E0443C97F0A48BBEAD0F29
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024
Preview:	!function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"1","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 93 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	561
Entropy (8bit):	7.415138128865445
Encrypted:	false
SSDEEP:	12:6v/7d4EkqImktpO/6TpyIKOjtpQMjypdWospz7TaD8imYhj2QQ:urKmk6/6NyA2ovpzXkmYh27
MD5:	C56550144E45B5BA82B2520F84BF24B7
SHA1:	DF44D7E2ED25EB669864C37B98AB6E6F286F7CB8
SHA-256:	66A7D415573A91B1AB1FAE594B4895038BEB3DB1E5856D56236E4ECA8D741BE7
SHA-512:	A41B5A62BD69C1BCDC26B84F20E1E976227C9640C34B6D5BE30A6E5051C3678176CEE0F4DA800725892B6054F1BB09A4FB7B916A2311E071E70B769ACF60A28D
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BoardChartUp.png
Preview:	.PNG........IHDR...]...x........t...TPLTELiq. W.5g..U..U..T..S........U......Yp.+Dx.....U......5N........t.......<.................tRNS.?....Df.6.........pHYs................iIDATx...ao.0...........=...%q.9.e..a...R.Z.,.,....)V.L/Wy.X....-Zwm.+..i..5u..1mJ.6...w....u.....6@<..C....A..d0....(.$..........t.Q.c.Im....g...S..o.#D.......N.....W2......H.\|.`]...../\|8..............Sz..l..\.A:.e.>iHi.C&...$.L.e..){..'3.D...d.l.\|.../\..o........l2.Nf..l?.....>U...[.q?..3x..Nq.B..}..a.W=.../d.Y.&...MV....n.K..eY.{./.....X\....IEND.B`.

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51645)
Category:	downloaded
Size (bytes):	350307
Entropy (8bit):	5.393621304488295
Encrypted:	false
SSDEEP:	6144:qpH7ZuqIn70b5GS7y9VSknncVPnTYJJ6f5hJGXRqXLN8EqnmP10j2KUFoQmr:qNjInuTknKPn6JQmr
MD5:	261CD9524DE1941C0ADBBC5AB40E071F
SHA1:	B1D444CB7950CDABA1A586656133D83230716535
SHA-256:	90217691EF650AD862929297EF8A897D5FED3D2A44B042274C20B0529907E375
SHA-512:	7C332A531D7D0DC9485B38834ECA94BE69B8657A2292341A36B11371604A2FF31026F20F02EE3DAB2BAB0C5814A627280925843F347E594A7085776EEDAA231E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function DSF_url_builder(){for(var e in _i_("ec2:fdb138b6"),this.buckets)this.buckets.hasOwnProperty(e)&&(this.buckets[e]=[]);this.processed=!1,_r_()}function _select_event_cat(e,t){_i_("ec2:39bae2c8");var i=$(e.currentTarget);$(".lp_events_categories_tabs_tab.active").removeClass("active"),i.addClass("active"),$(".lp_promotion_cards_list_child.event_card").removeClass("show"),"ALL"==t?$(".lp_promotion_cards_list_child.event_card:lt(4)").addClass("show"):$(".lp_promotion_cards_list_child.event_card."+t.toLowerCase()+":lt(4)").addClass("show"),_r_()}function _expand_events(e){}function _prev_event_card(e){_i_("ec2:376c6086");var t,i=$(".lp_events_categories_tabs_tab.active").text().toLowerCase();0!=(t="all"==i?$(".lp_promotion_cards_list_child.event_card.show").first().prevAll(".lp_promotion_cards_list_child.event_card:not(.show)").first():$(".lp_promotion_cards_list_child.event_card.show").first().prevAll(".lp_promotion

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	83082
Entropy (8bit):	5.765551149637233
Encrypted:	false
SSDEEP:	1536:vGSvdwaukJml5bMzae16nUNilJe8R8PwME:Ykk7M+e/ilJz7
MD5:	90AF4F7D03ACDF40D8242F30E2FB0A85
SHA1:	794AACEBE6E9B2C3CBC87F624F67A0B7B6149B35
SHA-256:	8D16DF006D670486595C7463E4C29A05D40E2060A38F1E86D9ECA270E2C60472
SHA-512:	5C9D09F5C7069A3934A56B8AC545691248DC577E16F7A96BC940E82C24F9778E431209570CE50F5EA0E7B548943370BE00F0D9DBB82A29B6765CD3A1519574D0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/1baf5a63.bda1a47c.chunk.js
Preview:	/! For license information please see 1baf5a63.bda1a47c.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["1baf5a63"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return $}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5316
Entropy (8bit):	5.421789526124162
Encrypted:	false
SSDEEP:	96:NOLIVc+o5OLzNROLukVc+otOLuBN1OLNFlOLNTFZKOLNZOLNJyOLNwOLN8Vc+om9:Yy9S5XjNFQNDN8NJXNtNGgN+uk+9iMGb
MD5:	8B8636331A6B899EFD46455309E2BA61
SHA1:	FD3177E2DB870E3E86C2B14F97AE7AADA55CE032
SHA-256:	87E788CB9F2E8A6B9D4E2CDB8EC841D65CF2D8A2DDD039C503D8CB68939B13E4
SHA-512:	93E9DB1C2C0A076889F4C2C4756BE25F75865FAD47B85D306A27B392C15827DD495B593508F451582A8FBE1D792DEB49121B4DCB87CD01494D34B68AB38F1BD7
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Cantarell:400\|Oxygen:400\|Roboto:400\|Ubuntu:400&lang=en
Preview:	/* latin-ext /.@font-face {. font-family: 'Cantarell';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015gqJrLK8.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Cantarell';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015jKJr.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Oxygen';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKgE0mV0Q.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360608028&cv=11&fst=1705360608028&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	672
Entropy (8bit):	4.88738061447812
Encrypted:	false
SSDEEP:	12:hYYLVKwFHCIaI1ByLc2VfTgDAM7QBDM75DM7hkgaPAxRW09eXM7yarBBxNtsbRz+:hYeU4iIaI1UDrCQB050AARW09dDrBnzj
MD5:	67B95267FEC9BF5EE45786BEF9D2B01A
SHA1:	346659BA1E68F661B9A0D897D15B9B38A3C1331D
SHA-256:	6501140033C3BB20DA4B5AC73C90F687BA8A2053C4BA37C4B6F5275166DB7FA6
SHA-512:	F5BECF4F2345D6E382665F700AFB5558AAA3CFD6B7A1336FA0592C303607AAD95FD724E8A3C5D52BB5FD37A8CB60AF31D20582C7B3FC5FEBC8BF9BB0F93A9C3E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f
Preview:	<!DOCTYPE html>.<html>.<head>. <script>. (function(win, doc, sdk_url){. if(win.snaptr) return;. var tr=win.snaptr=function(){. tr.handleRequest? tr.handleRequest.apply(tr, arguments):tr.queue.push(arguments);. };. tr.queue = [];. var s='script';. var new_script_section=doc.createElement(s);. new_script_section.async=!0;. new_script_section.src=sdk_url;. var insert_pos=doc.getElementsByTagName(s)[0];. insert_pos.parentNode.insertBefore(new_script_section, insert_pos);. })(window, document, 'https://sc-static.net/scevent.min.js');. snaptr('cm', { 'sync_modes': [140] });. </script>.</head>.</html>.

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (6420)
Category:	downloaded
Size (bytes):	10684
Entropy (8bit):	5.838726560242214
Encrypted:	false
SSDEEP:	192:qBshXMRyW6VCXHs8/dBN0gaXctCmcOVIaz8uTicTmfYHsya7AHTzhyIRaAHTlvc:gshXMRyWH3sqdBN6MgTVlomf+KcTFy6U
MD5:	679AC7D8DAF1220889F9C81D3C93E40D
SHA1:	0CC84019E1D49FDFC79FD0FCED283006E761476F
SHA-256:	0E4B2A7F86A11F13C4880A3EF4806FFD1CA16B296A20E59D09B174F093581D93
SHA-512:	B573341E11DE2D743719F30B0075860C4EE2848BBE766C36FAFC2EEBE2133D8F8693FF5A682A15628A361A89EB31240ADA5B15E141CD0B82D450C5E41893A40B
Malicious:	false
Reputation:	low
URL:	https://sslwidget.criteo.com/event?a=37158&v=5.20.0&p0=e%3Dce%26m%3D%255Bundefined%255D%26h%3Dundefined&p1=e%3Dexd%26ci%3D%26site_type%3Dd&p2=e%3Dvh&p3=e%3Ddis&adce=1&bundle=7WVaXF9aQTZ1YTQ1OCUyRlNudVElMkI3RURnaElZV0RsZnlETUxLYjNLZk9nSW9MRXZDOTExOGQlMkZobUhLN1I5c3EwaFg3NzFsRUhycDNDdDB3Y3c2VjNNSUk1VldqdCUyQm5nbG05VFg3T015Y2t3dlBSb2hybjQ0UU9TeTc2OXNtdEx2VVNBZEFBYmZBaUx5dXhGM0czeEZDQ29OZ3dsZyUzRCUzRA&tld=booking.com&dy=1&fu=https%253A%252F%252Fjoin.booking.com%252F%253Faid%253D304142%2526label%253Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%2526lang%253Den-us%2526sid%253D94b76ea7cb923e6da206675b5d1abbbd%2526utm_medium%253Dfrontend%2526utm_source%253Dtopbar&ceid=9ae4b0b3-9340-4a96-ab66-e32e05edbb1c&dtycbr=2877
Preview:	./* /(function() {var qss="&cb="+Math.floor(99999999999Math.random());try{qss+="&ref="+encodeURIComponent(document.referrer)}catch(e){}try{qss+="&sc_r="+encodeURIComponent(screen.width+"x"+screen.height)}catch(e){}try{qss+="&sc_d="+encodeURIComponent(screen.colorDepth.toString())}catch(e){}var callDis=function(e,t,n,o){function c(){callDisInternal(e,t,n,o)}"complete"===document.readyState?setTimeout(c):window.addEventListener?window.addEventListener("load",c,!1):window.attachEvent("onload",c)},disCalled=!1,callDisInternal=function(e,t,n,o){disCalled\|\|(disCalled=!0,n=(n?"https:":"")+"//"+t+"/dis/dis.aspx",(t=document.createElement("iframe")).width=t.height="0",t.style.display="none",t.title="Criteo DIS iframe",void 0!==o&&""!==o&&(document.body.appendChild(t),null!=t.contentDocument)?(t.contentDocument.open(),t.contentDocument.write(o),t.contentDocument.close()):(t.src=(n+"?p="+e+qss).substring(0,2e3),(o=document.getElementById("criteoTagsContainer"))?(o.appendChild(t),"undefined

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39706)
Category:	downloaded
Size (bytes):	39899
Entropy (8bit):	5.795001344137097
Encrypted:	false
SSDEEP:	768:o0g0lR4bh5jL6wtWn9OKM01Pdk3Jen0W8JMsYU3Dy7736KTi3:A4lGOP6r3
MD5:	737B7A6087D435F836F109FCA288B92C
SHA1:	E3B62481EBFEF98006C2CA6256B3D5384156D542
SHA-256:	EFC83B96EC4D8FD61150B776B0261B0C50C25C4E7E18379AF27D35AC3D350C15
SHA-512:	5EF403EAD31A9FD4DE2E354027BC53BAA68DCBE9DF052BB5D0AC3E1F219755604B0DC9F4F006982C9EE41CDF8937549A4FD052B7AAAE057055CE89BFB2EDF1D2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/53a8d0d3.088af158.chunk.js
Preview:	/! For license information please see 53a8d0d3.088af158.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["53a8d0d3"],{"51a388c3":function(e,t,n){"use strict";var r=n("6e8b4072");t.Z=r.Z},af1e2b38:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n("6ee88c54"),a=n("dc6d28ff");const i=()=>{const e=(0,a.getRequestContext)().getSiteType()??r.N.WWW;return{isWWW:e===r.N.WWW,isMDOT:e===r.N.MDOT,isTDOT:e===r.N.TDOT}}},bca4b277:function(e,t,n){"use strict";n.r(t);var r=n("ead71eb0");t.default=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M.153 22.237l.85 1.117c.634.76 1.724.856 2.456.244.078-.066.15-.138.216-.217l.944-1.132a.228.228 0 0 1 .349.001l.944 1.13a1.728 1.728 0 0 0 2.651.001l.944-1.132a.228.228 0 0 1 .349.001l.95 1.132a1.728 1.728 0 0 0 2.65 0l.942-1.133a.228.228 0 0 1 .349.001l.942 1.13a1.728 1.72

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.841014016708303
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt0gEi16bP5vsLqo4p:VKEcPw/VKonR3evtTA8O01iGLrwUnG
MD5:	3259D942739B9C07E25675A3049492FC
SHA1:	95041E8A70CF23B17C1F411EEDC9663BC901BD57
SHA-256:	A40DD5CFB0DD11AAB95CF3D51B8681AA1A0D3DCC22D1FBCEA28F26C02FB50A35
SHA-512:	5B8F27594AE3E0603F5E85791824B4B3F5CC92D4DB59E332FC22FE522716936C3BB8DA04B59860EE6AC7A91C3A93A178B907D21E3842EDB16E654325C733AF61
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360594846
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/reca

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3012), with no line terminators
Category:	downloaded
Size (bytes):	3012
Entropy (8bit):	5.965653245135638
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08g3IcDsmVH/KMtptzYigE3n:wsbSUtJfxrqLWWWdV6j14I8HyMNlKTzo
MD5:	50E10D9EEF44D14241C0C81EE0050F9A
SHA1:	F86EC9600562C33F0DF751D2DEBE29EDD049A1A6
SHA-256:	69FD9677BF26A80C00B969D05CD5F8A2165741DFA511E4BE81B2066F547A9B56
SHA-512:	E2BA8BE3492DCB632AACE2E04ED1710A25AC12A7034D585EE52DB7FA3CDFDD61919298A13F488B80EC1933B62408740F0FF7B2FF2BE2289520490EB8842AEE8B
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1705360607860&cv=11&fst=1705360607860&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	120436
Entropy (8bit):	5.336222005752591
Encrypted:	false
SSDEEP:	1536:meu5rTiSJ2lBJs7gV+3FxuBIRwTcDmUrdK6ERYFHUTu4w3:mdISJsJb+1oWRycmRaHUTu48
MD5:	666F1D5F09457615243BF4310F5C3E48
SHA1:	9B4F21312BBF59A1E30ABF4E4DB6CCC5A7AA597F
SHA-256:	4EDF6972E93E28D325080452B9E82A312493E68327E9CF374C27D9502F07176D
SHA-512:	4940BE56B5BF4D1D6F655249A99C831DFAEEC7DC9AE63C8EC1FD2E30C4657376C5255823DF2E037A8FD1BAA3F37ABA0930A7A31DF71F31E8ABAAB547D9566EE6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas={loaded:!0,run:!1}),function(){"use strict";_i_("d0b:3557c07a");var t="Atlas/";function i(e){return _i_("d0b:212232c8"),_r_(t+e)}function e(e,t){_i_("d0b:9d1725e1");var r=[].slice.call(arguments,0);return"string"==typeof e?r[0]=i(e):Array.isArray(e)?r[0]=e.map(i):Array.isArray(t)&&(r[1]=e.map(i)),_r_(B.require.apply(this,r))}B.atlas=B.atlas\|\|{requirejs:e,require:e,define:function(e,t){_i_("d0b:6f103607");var r=[].slice.call(arguments,0);r[0]=i(e),Array.isArray(t)&&(r[1]=t.map(i)),B.define.apply(this,r),_r_()},getVariant:function(){return _i_("d0b:fa3ca699"),_r_(0)}},_r_()}(),B.atlas.define("jQuery",function(){return _i_("d0b:2b36fd1f"),_r_(B.require("jquery"))}),B.atlas.define("util-array",function(){"use strict";function a(e){if(_i_("d0b:9f857ed0"),!Array.isArray)return _r_("[object Array]"===Object.prototype.toString.call(e));return _r_(Array.isA

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	dropped
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	168278
Entropy (8bit):	5.07827049480942
Encrypted:	false
SSDEEP:	3072:3OKSKg1/Cgu9LaMyh/MDe3jyGsADi+BmuN+BjbW16qfxQrYHlCO:eKSKg1/Cgu9LaMyh/MDe3jyGsADi+Bme
MD5:	63163CF040DC9A8ACD6A9DE613C33E08
SHA1:	28CB29B61C0D4B9C9D7B6993A0C5547CE0C5D9C7
SHA-256:	DE069C51EC3B9926EE97D3BDA3A73BC6C5BDB1CE5854F1044B717376D2D047F0
SHA-512:	FDC89D4D6328B302941BC091424F648CDA94843DEA9CDB5A985F19452B10E6F6FC0A9BB8D5DF155A55FA0685181422B31BFAD8DD1EB8DD208C530A4476FF664C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css
Preview:	.b-booker-type__container{display:inline-block}form div label.b-booker-type{padding:0;font-weight:500}.label-business-trip{display:inline-block;margin-left:0;margin-right:5px;border-radius:20px 3px 3px 20px;padding:0 8px;line-height:24px;background-color:#fafcff;cursor:default;font-size:12px;font-weight:normal}.label-business-trip-icon{display:inline-block;margin-right:5px;color:#bad4f7}.label-business-trip.jq_tooltip{cursor:help}.label-room{background-color:var(--bui_color_white);border:1px solid #ebf3ff}.label-business-trip-icon .bicon-pricetag{vertical-align:text-bottom}.uc-company-section{background-color:#fafcff}.uc-company-section a:hover{background-color:#fafcff!important}.uc-company-details{float:left;width:237px}.uc-company-section-2{position:relative;padding:5px 0;background-color:#003580}.uc-company-section-2:before{position:absolute;content:'';top:-20px;right:10px;border-color:transparent transparent #003580 transparent;border-width:10px;border-style:solid}.uc-company-detai

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057604
Encrypted:	false
SSDEEP:	3:D9inuSoICkY:D99SckY
MD5:	3955EA3429355866DAAE8DD5739A2FC6
SHA1:	691AEC4F58E4E8B46726F8873730F11D65FBBC15
SHA-256:	AB22FCFF7DF9B19212A4DC7EF5EF56B394D001490C3917FAC266D7BAF77DF497
SHA-512:	B082AEC52067D34E698A52BE8DCC28CEE1F7D6756AD54A7FEE09C5F9A6B3E684EA3B379864242DECA6A58F8711AA69E16DF097438C03A0EA5DA6BD9435725F67
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlmXxtZnE_3AhIFDZSQkvoSBQ1TWkfF?alt=proto
Preview:	ChIKBw2UkJL6GgAKBw1TWkfFGgA=

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	7.756974676688925
Encrypted:	false
SSDEEP:	24:zn1XTOSh5oncvg3/pzi9NUvZi/GZu4yVEb6cgfes54AVi8TgBgWPPKWfW:zde/3x+1OZkEbhgft5TbTgdPDW
MD5:	6384185CBE9A4F106857A3CB85CAEA98
SHA1:	0E31A4FE2CE98A8B4FDA60687AA71079B4D3A95B
SHA-256:	5839F0330821CF08029BEDDD6D248170DA1AF16CD7AFF253E7BD075D591F5D42
SHA-512:	E9C784DACADEAB6C3FAD53729701708EC5C21670086AA981953FF2D44DFB08BE13134707A4E7405826CC0D11C68F3AECFD6601AF910C537F6E14AF68175B50B7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png
Preview:	.PNG........IHDR...O..........w.....IIDATx.....:..sl.g.ym.{ll=.m.m...f^.A.1zhg.i:...ZM..5@.YF.................o....hU9......B.s.h....<......=~........b..'.....5.l`..V...z...b5...E.........8.........f.C[.lS..z.IcI...X..r.:......x.Y.....}+.h^G....3......6.Ni..........G.......S.....W.Is.I..S.`.e..)p.hh..T....`...Q.....V......".}.X8..v........k......84.....-9..d.....lq....FuA.zJ5._..@cX.../....a..y.....;.r.>Lur[.w......O._~..:h+H..>.y...p...4..{.\|aBu..y].....a..w&L0.Y.e..}U...'.s...=.......n..^.r...+].I.-G...r....8].FkR.'.......u..e.c..w..%@.}.e...#..K..w..Ak.[@.R..gY.u.2/..y.Q.n.O.......]y.n..pk8.s7.......y.:..F...M..h......y....`..O....i.zqp..<........Zp..h.+..@...;/.#...0..u..N...v..)..6Oq.d..n<.M../.....0....EMn...3..=Q......r..../....8...'..wv/.w..'MS...[..........<.y}...4.Nm....qk.9d. n.Y....yZ1.?..!..Dg...m....;.N...A...I3.gn.]G.A[.w....7.6Om.........zD....v....._.D3x.v...6.]WR..7........=.."4.....\|.......:...a...Z....~..\..~

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	low
URL:	https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-9S_M1EwC227b84Dh6MIXwLUNPlJJYMCuDuORSQ&C=1
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43452)
Category:	downloaded
Size (bytes):	43564
Entropy (8bit):	5.279178813374149
Encrypted:	false
SSDEEP:	768:UQ3Qa7AHgjRnTGm3+xgipCMCtCmCMCtCJ1Lzebwiv1ueVotjUubC:n7AH4/+xgpBgjBg+bBu3JUeC
MD5:	A49FEF705480F68E235A3DDEE061E361
SHA1:	0AC03E6ACE43673FD880F1F987F1A10A0C3FA62E
SHA-256:	51F83C2E2EC09898B6653E3634D497E97020EDC90D9BDF89FAEE3CB6D3D1DFA6
SHA-512:	84B0E64168F91753A6849860241CAA4E32A7CB5D02BF8656016010C9002B0988815C153D745BD11122F855AAAA037D2D9916AAA4BCDD57A10505FC132E1E62E8
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/7a53cdfb.692b69e3.chunk.js
Preview:	"use strict";(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7a53cdfb"],{"77b870fa":function(e,n,i){i.r(n),i.d(n,{default:function(){return Ve}});var t=i("ead71eb0"),a=i.n(t),r=i("3d054e81"),d=i("dee2534d"),l=i("6ee88c54"),s=i("dc6d28ff"),o=i("28dbd132"),c=i("c44dcb0c"),m=i("2f7c7336"),u=i("e7547f91"),g=i("a6b472cf"),k={trigger:"fc2f2c0da8",header:"d840541ba4",content:"ae9536be5d","section-expand":"f522a8d44b",description:"dc625444ef"},v=i("0c68dce6"),p=function(){return p=Object.assign\|\|function(e){for(var n,i=1,t=arguments.length;i<t;i++)for(var a in n=arguments[i])Object.prototype.hasOwnProperty.call(n,a)&&(e[a]=n[a]);return e},p.apply(this,arguments)},N={"flag-ua":"Ua","flag-tr":"Tr"},S={default:v.Z},b=p(p({},N),S),f=Object.keys(b),F=function(e){var n=e.icon,i=void 0===n?"default":n;return"string"!==typeof i?i:i.includes("flag-")?a().createElement(d.Image,{asset:{setName:"images-flags",assetName:N[i]},attri

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	229775
Entropy (8bit):	5.4863596898661795
Encrypted:	false
SSDEEP:	3072:3I3yE3T3j0BzWpaxRUnk/T04NZsAJ/0D0MbD1v0nPFzp78aUXEjgLw:3I3Trj0BzWpaxRUnkb04NZh/0l+F8Lw
MD5:	4656ACE9012FA3B7A4CF9353F780165E
SHA1:	2AA32F5460B0E62C3A61DE9D4E92CFB235A2030E
SHA-256:	0F2C2BCC63F96174204BAB2090A883BEC861925EA68179839B3EA4C1D723FF64
SHA-512:	33FC29DB12C2FC6AB87C8A897D957F5455658B5BE2A980B28C712604D920F9778D424D5C224E90E436A0D5010C6416EB6DD213836B4781AF2D9FEA2E5979A335
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4ff72d09.d3848f83.chunk.js
Preview:	/! For license information please see 4ff72d09.d3848f83.chunk.js.LICENSE.txt /.(self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4ff72d09","5526b828","18534e30"],{"61227f07":function(e,t,n){"use strict";var a=n("ead71eb0");t.Z=function(){return a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 128 128"},a.createElement("path",{d:"M56.33 100a4 4 0 0 1-2.82-1.16L20.68 66.12a4 4 0 1 1 5.64-5.65l29.57 29.46 45.42-60.33a4 4 0 1 1 6.38 4.8l-48.17 64a4 4 0 0 1-2.91 1.6z"}))}},"43bedd84":function(e,t,n){"use strict";n.d(t,{p:function(){return a}});const a="Booking.com"},"98a9fb64":function(e,t,n){"use strict";n.d(t,{e:function(){return s},u:function(){return l}});var a=n("ead71eb0"),r=n.n(a);const i=(0,a.createContext)(null);function o(){const[e,t]=(0,a.useState)(!1),[n,r]=(0,a.useState)(!1);return{isEmailVerificationOpened:e,verificationForError:n,openEmailVerification:function(){let e=arg

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1525
Entropy (8bit):	7.814357698865404
Encrypted:	false
SSDEEP:	24:mgUT1nDK2aDPf/6Oa0oYSuAq0gEMWZIePHiC8JRO/S1Q7ZXnrTTnEqtIg0:mgU5nDKP/6OSiWZIE61ovCl
MD5:	A46B40CC66DFC5D0FD0EC67789FF9170
SHA1:	BDF029ECFC539D46FE52CC7D8B5D55478BE969FB
SHA-256:	A5CAFE947DE2C68DF857B8493337A719E97DE77EB56106BF650B89B8AEDE7455
SHA-512:	87FF1DD7314A8764D9224CE2F8CDF469AF63F09D05C8CB482F73A97A25E99623895696E07CFAD0138FA61A6890854044ED291B152BAEE1F29545324C46355EB1
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/CustomerSupport.png
Preview:	.PNG........IHDR...[...x.......~3....PLTELiq..U..U.....U..T..T..U..Uy\|...U.Z)..U........T..U..U..T...............y..............(M.....................g`p............U.........V@<$=o..../c.#X......La....;R.............v...._q..)Mn...h..V,nJ5.R0...M......tRNS....k.....U.....4J'.%On...7..B=....a.q\p..]u"+....pHYs.................IDATx..is.:.....v..vS........;M.._.m....E..<.2....#.).....a.Il...,.\|EE.E."3.E."3..[...?...P..h._p+5V`..n..-A.Y..P]...4....x.....H.....R.....j<#...PoGF.1,...s.z.1.......nV..=."K..U.p\.L...........6r.4.+..Z..I0F#<..FfL..a..%....B....Tx..D.9..d...J(. ...p...!.O=..x.X.E..I...$D.e".....+.!.-..~...*0...?..5.y...qtC...M/_..l..}z.u..e_n{VJo...n.{Rna...^.v..........v.!..v.r{)w....[.=Z.Sn..,2KX5...a.8~.....%.0..no.8.3J._.U.n..r/.N..{.....Uh..M._...G..r':....p.g.....q.[...\.....q.B{...8V;....d....no.....5;.>..)...[.....t<.G1G......A..<.d..:....._J..[...?=...4.q.P.s.@.C..z.n..p0%..t...........%.....!.^$..;q.i.L....e...F..u2..+.J\|

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5364
Entropy (8bit):	7.906665501686905
Encrypted:	false
SSDEEP:	96:ghIEhDH7a2DwHfLef7khjhS69A5zUGsw58RcmUSvE3WaLZwn:mIcDHWvjeEj45zxsivV3DLZw
MD5:	06BE00ECAED1E83D7B95EF8E24BDF64F
SHA1:	C07FDDDE0568E47193737A9CCF93E1338477D52E
SHA-256:	DB3E2202C7980ADD6476E2126A65D4460FB4ED5CD92D59DB603D4120EBDAEE9E
SHA-512:	392DEA2CEB22FCEE7D2448017DDD4B0E404C30B44EAD739EE388BEC4FE85D4AA520DAA7126D09E9F24130CA9384CF9DA5B27D15462D00B4660221A4BCB548AE1
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."... ..q...`o...t..O............z..i..Fcu.....CU..x....r........Ty...@..* ..\c.W...}4.u...Rb..Jb..B)...q.".......x..I.n(..Rb..1@Xf)1O.&)..b...(..9..FKyUm..@..#`......{V...mv.S..G.d#..=+....:.......%.}B....]c.8...R.)....~n...b.RL.....bI..>ea.H.......\ Y.v..q\]..*J.$..+.......Z....]J5`M..?!q...j....~.n...t.w.N.).F}...2.......K...l....z.Q\...qW....:.m..4RC..?.G

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4228)
Category:	downloaded
Size (bytes):	4344
Entropy (8bit):	5.211487803575441
Encrypted:	false
SSDEEP:	96:51kj5msLH21I3Mmfk4gtThfYBTnOgsE+C:51kj5hC1I8YeThAB7V+C
MD5:	88D8B9631FE60984BAABD22260A86E6E
SHA1:	B75D25134DEA474C10A42B570D1A0450C194BD7E
SHA-256:	493A3B2B0F2970B97F00FC6C123CEFC68D2AA27BA9433A2989F6C278D623BA70
SHA-512:	650F138A4FE435B277039403E904BA75C0DF7EF2DC8FC25C3CC237BD0BB6BFD034312ECD4AB755434C161A4E7A563A470F47E02114E70E592B7E364F603624E8
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css
Preview:	:root{--gnsv_brand-secondary-color_web:#febb02;--gnsv_lp-campaign-card-height_mdot:176px;--gnsv_lp-campaign-card-height_www:208px}.f420f6bbf2:last-child{margin-bottom:0}.f420f6bbf2,.f420f6bbf2:only-child{margin-bottom:var(--bui_spacing_1x)}.eea513fff0{display:none}.c72aded5f7{display:block;margin-bottom:var(--bui_spacing_4x);padding:var(--bui_spacing_4x);background-color:var(--bui_color_white)}.c82d14d624{border-radius:var(--bui_spacing_3x);margin-bottom:var(--bui_spacing_6x)}.c82d14d624.de712accea{--bui_color_brand_primary_background:#003b95;--bui_color_cta_background:#006ce4;--bui_border_radius_100:4px;--bui_border_radius_200:8px;padding:var(--bui_spacing_6x);border-radius:var(--bui_border_radius_200)}.e7ce666a86{margin-right:var(--bui_spacing_8x)}.dccdf01c32{flex-basis:280px;position:relative;align-self:flex-end}.d6bedc5a57{color:var(--bui_color_brand_genius_secondary_foreground)}@media (max-width:575px){.c82d14d624{margin:0}.c82d14d624.de712accea{display:block;padding:var(--bui_spa

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47124)
Category:	downloaded
Size (bytes):	47458
Entropy (8bit):	5.330876718825298
Encrypted:	false
SSDEEP:	768:9otj9ZnFwCahdv3xO3NxzKVebMAPA5845d7GrejEfWmj3SIk:QIzhdv3xINtiAP7ejL
MD5:	D8F7E147D49ED3AD0EB1048E9E8E4E49
SHA1:	92A285F833D21E086F50CB90624673E33CCF1852
SHA-256:	4DFDCFBE1DC27EAF6D1449A3DFE6EE61D5B746C117C44486D7B62A651ED14950
SHA-512:	EC21E2E426190D012C34D2C3A8A44A7CE25CA77326201F109BBFA6B5ACBF62549BA60FBE4885DC331E80E75F062638CBEF2E60BA7600E6993546E89A46F5FBBE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/core-deps-inlinedet_cloudfront_sd/65bb6e0c1caef9acc68156912864de9c2c826461.js
Preview:	booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.core_deps={loaded:!0,run:!1}),function(){./*. @license almond 0.3.0 Copyright (c) 2011-2014, The Dojo Foundation All Rights Reserved.. * Available via the MIT or new BSD license.. * see: http://github.com/jrburke/almond for details. /.var e,n,i;!function(d){var o,a,p,h,m={},v={},g={},_={},t=Object.prototype.hasOwnProperty,r=[].slice,y=/\.js$/;function w(e,n){var t,r=B.env&&B.env.b_dev_server,i=(t=B.reportError)&&"[object Function]"==={}.toString.call(t)&&B.reportError.bind(B);if(r\|\|!i)throw new Error(e);i({message:e},n)}function b(e,n){return t.call(e,n)}function u(e,n){var t,r,i,o,a,u,s,c,f,l,d,p=n&&n.split("/"),h=g.map,m=h&&h[""]\|\|{};if(e&&"."===e.charAt(0))if(n){for(p=p.slice(0,p.length-1),a=(e=e.split("/")).length-1,g.nodeIdCompat&&y.test(e[a])&&(e[a]=e[a].replace(y,"")),e=p.concat(e),f=0;f<e.length;f+=1)if("."===(d=e[f]))e.splice(f,1),f-=1;else if(".."===d){if(1===f&&(".."===e[2]\|\|".."===e[0]))

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1321)
Category:	downloaded
Size (bytes):	17314
Entropy (8bit):	5.342134706855769
Encrypted:	false
SSDEEP:	384:cCDFzlR6exHAiyyrYuy9ckdnfczIk7LcuNP/p:DlsexHAlii9NmIeLcE
MD5:	2CC87E9764AEBCBBF36FF2061E6A2793
SHA1:	B4F2FFDF4C695AA79F0E63651C18A88729C2407B
SHA-256:	61C32059A5E94075A7ECFF678B33907966FC9CFA384DAA01AA057F872DA14DBB
SHA-512:	4ED31BF4F54EB0666539D6426C851503E15079601A2B7EC7410EBF0F3D1EEC6A09F9D79F5CF40106249A710037A36DE58105A72D8A909E0CFCE872C736CB5E48
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/sodar/sodar2.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var n=ba(this),p="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),r={},u={};function w(a,b){var c=u[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}.function x(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var g=d[0],h;!a&&g in r?h=r:h=n;for(g=0;g<d.length-1;g++){var e=d[g];if(!(e in h))break a;h=h[e]}d=d[d.length-1];c=p&&"es6"===c?h[d]:null;b=b(c);

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7107), with no line terminators
Category:	downloaded
Size (bytes):	7107
Entropy (8bit):	5.033756712873933
Encrypted:	false
SSDEEP:	96:6wIpQgOR15Y2/xFTera/r5rIr+rsWUCeRmFaIkWmGu0hV0b0xG5GlGTY/dLWb3RL:LIy3P7JQZW16
MD5:	F841B7B83EAE48FBF4574D3C0D53F4C3
SHA1:	E104126E57648FF6D51BF6ADE1357BC03CB500C5
SHA-256:	0A5447D9BE398DA3541FE01668F81B332FD26812C2842AA53DEB5C7883D58F73
SHA-512:	A1242457657CE06C62A487BCBFE78352910D530097F5EDA816E266E131201D5B543AFD8E244CBD28D53CBDD971532C06CE14E06A429681EAE8F9B9C116775331
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css
Preview:	.rewards-incentippy{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy/d95ef8dbbf70b932813312468b55608088e91dcb.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-gray{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy_gray/2bda4622f06519a8b7a2173d4d0768ed9b7cf50f.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-big{width:61px;height:48px;background:url('//cf.bstatic.com/static/img/incentives/incentippy_big/6073affa42fd7928b52ac15b5feaab77939687a5.svg') no-repeat 50% 50%;background-size:61px 48px}.rewards-gift-big{width:50px;height:50px;background:url('//cf.bstatic.com/static/img/incentives/incentive-gift-box-round-100px/d45438b0be0d579426436f74c2a77aef42d44c97.png') no-repeat 50% 50%;background-size:50px 50px}.rewards-ribbon{position:fixed;bottom:0;left:0;right:0;z-index:100;background-color:var(--bui_color_white)}.rewards-ribbon__icon-btn{float:right;height:24px;width:2

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	375
Entropy (8bit):	5.631187580241556
Encrypted:	false
SSDEEP:	6:+oUp1JyUp1JLr6QQ1P4dtsyXiO+T37h4pIoauwiRzSVV:+F9KGyKiO/IoauwiVSVV
MD5:	71D148D7E362A60E9A0C56222E4C1C42
SHA1:	EFA6833AFFAFA5EE32CC538C0EE386673C92D169
SHA-256:	EEFD6838A88FF46EFD00A91C0C63F124352BAC2D328F583E87CAFE87056AAD31
SHA-512:	9EADD8798A416985F0C32BF711A36403E9B0641EF2FDB3E3D592F719A3D1171FC211438DCC1BB20578148647AD62F2785D3CCC20D1EE6BAC4A6D9ED4A372A594
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4a89d2db"],{fe905f7b:function(e,_,b){b.r(_);var d=b("540adcd8");(0,d.serve)((()=>b.e("0a098284").then(b.bind(b,"64b778ad"))))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/4a89d2db.6c0ec4b3.chunk.js.map

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21099)
Category:	downloaded
Size (bytes):	21100
Entropy (8bit):	5.307417161176307
Encrypted:	false
SSDEEP:	384:TRFZ2wWtdbD5ABwXwLrekrff8eTr+xITxMcSn9LuJPvV/:T8wAD5ABwXw+krfflyxUxan96/
MD5:	72B4D7D753CB0A37F1E4B3320756A981
SHA1:	99D4AD9F237F361D595D1657E65CC3E5CA43BAD6
SHA-256:	98BC0753B3F7392176A4AF252BFAE9BCD1F2804B73DEE374119899D8F52AE3D2
SHA-512:	E263590CFB358CA7BD881EC10D765FEE20A27530F2AE2FCA680F76E54ADC4AB17BAD76DE1BDE1E24AA0F8CADBB8BD08CB6D7087F6498A81CF4F7C61BABFDA82F
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(m=g=g\|\|{})[m.Days=1]="Days",m[m.Weeks=7]="Weeks",m[m.Months=30]="Months",m[m.Years=365]="Years",(m=i=i\|\|{}).Name="OTGPPConsent",m[m.ChunkSize=4e3]="ChunkSize

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	677
Entropy (8bit):	7.575211646320257
Encrypted:	false
SSDEEP:	12:6v/7HAMhHnOUO6n+M1VKTVc8OPGCg7QIrnHFyzdrVFNVHI6w2c:ahHOT6zfKTAxg75HFILH6F
MD5:	985D500E868764DCE857B43C97BDA06B
SHA1:	E63F372410FFA0F0F7B3F82C76A6EDDE04B66228
SHA-256:	616FE7542FA3440682C18C0B2377EEBC82848CD7A0976DDECCB4ECD228131AC2
SHA-512:	EB6E7682C957CDAC09EED159C9927C2C14EE89E44B8BE634AF67907A7869A1D49559305A663DD47AE8BEF8A49EB458718EEA71C6F782954291473D51060F8152
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H...0......B.....~PLTE..0....x...5E.......0...<:p.s}....HFyTS.dOz.;J.;Imk.a_....yw...............'A..........mk.......`_.....d{..........@V5.e.....tRNS.......v.......IDATH...r.0.D.%.h.H.u.h.f.....h.l.}.U.....&. .....T'Fl..@...wg[kDq".I..g..r.0...E.....q}.s^.....}..kdDKb.0:aHV}...M]..cT.I..$...........3H$$...VkD1.>...."l.1..C...g#..u....?...UvMD.....O.72.DJ...~.w;.4\.s..9.L.......\.y../.hk.....0..a....0...@z9.y.......[9.......a.....c.UV..O.anCd.(.2../J3..pP..v......AiX..DD.3c=.sB.F..I.G...X#;.Q..WLlY.+...r&L<+g.e.wL2..7u..}.8..Ku....U..&c^..F.:.o...cS.].FW.4zl......=...............VF.2:`.[.=..d...$~.....IEND.B`.

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 112 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	917
Entropy (8bit):	7.637544373113396
Encrypted:	false
SSDEEP:	24:rwbsAiaE/6xi/NTzTZ4hxG7Bxqls6/kFy:rw7hE/6xi1fMUQmQ8y
MD5:	1DC79937E26730D866E5F2BB75B34417
SHA1:	5A3864F0338A83A7E689C0B062B9640BC0ABD914
SHA-256:	BDC9FA6B8E3557B42768FD4A878F1467974C0BCDDF9BFD14CF4AC1F351C3B02E
SHA-512:	25CE20E72D008EDA7A485CFEA1666DE6D3471D87C3D4C095648AD319D7B6F46499D10B34C4028EF85F24224F632DCBA4B32386D5592AA15BFFF702C63FFEB473
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...p...x......m.....cPLTELiq..U..T..U.....U..U..U.....U..T.........i.........U.........Xv...............&....r4Q.....gS.S....tRNS.4....w.K\...M.q.kL....pHYs.................IDATx.... .@..0...3f.......&hH..fS..%>p./R..,K$...)..r1%@........\.6:Vp...h.......t..X....J,....,..Yx..I'&.8..sZ_.d.....C'G..I.l.0..b\1.g(....k7.B......\|.....i-".t.E......{4.&d]. 3`Y>.(...y.%k.%.J....._...gvn.a&....J.o.q.y......M...P......g..X..@a,_..&\'a0.)..M.[.u.S>..p........qN..%,.6..)./.4.Zk.........cl5T...\|^..<,...d. .>-..>2k....>,.V.P.........%...W.p$..[.8D.pJ.zJ....h.n..3......q...Cg4.&..6...Y",me....r.y...t..HX.c.v.W..a..R..4..R!.....,.BF.4.V...{5./....E....^..kj.B..3.._*4..n....G).'......p.....9[T....F.$.../ei....!.PA.o.....0.o./..y{...1N.WW...W.w.p..v. o.{.\|.>u..<...e.tC4ln...57}.....x..5q..x...x..I.$8..?A".Z\|.....b....R..T.....L.M1...fM5..A8..H$.G..>....t......IEND.B`.

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.646804061285085
Encrypted:	false
SSDEEP:	6:YNMa9YaeRbUHjG2+z/iJJR7rH0jofXbov8iVHzs5:YNNGa0+CXz/ixH1fXboEiVHzC
MD5:	AE69C8503B6F3578CC6865CC07AED615
SHA1:	2C8D6CA874182456E8420C9F169414FA329482CE
SHA-256:	3F9D66FFA46B776B90711959D000D3ACC17EE6930636916B730598B49CA0C524
SHA-512:	2C7DC6DAD915287E432F7F7BEC979980CC28A16FC5B4A36B55F86D793A8A072E35A5CC245CC58D6C704B781E50E735B38B8F3D7A423CA24B6E776B34EDF21EFF
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CIyZlabD4IMDFWfQ4wcdBLsF-Q",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qMHHrwdmM1deqi60QOABkHsb0CqK_b--BSF50UUnfV87pxHbISxYZLGYJkwZGnlrjXL8dYijcympg0GoP-nBcOz6zV-RA"]}..

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1949)
Category:	downloaded
Size (bytes):	2065
Entropy (8bit):	5.192719296491818
Encrypted:	false
SSDEEP:	24:04WV/aJCQI27PWV/d1COAKrW+EA+JzAaotdz6C/f2GPGPXBqB1+vq5:04aCJvTLa7tbAekC/fnPGPxqB55
MD5:	9F91BB862449CB9E9205F6F0A89B9ECA
SHA1:	C9664885B77F670F955ACBFA0E4C417D6CB1FD32
SHA-256:	304F8A600D68F795F540EF1645BDE0F8A2E8F23E6AB3788E494076ABA6E26B76
SHA-512:	140F355792DD4CD6F742851FB96A22B1F6CC5E8823C59C076F18083C4FD394B6F3A4B4869EFF9FD383B2ACDF4C4802018A0DDA9B9ABA3E1C9375F95FF4A9463E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 260 x 260, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	19613
Entropy (8bit):	7.969431801124411
Encrypted:	false
SSDEEP:	384:mjUbVaLUNIUKCJonomVl0plKjyiJgiMB4/gQsxv2xnQGjQ4SGte5/vjcVwVlRtfH:CGaLUuGqom+lKjyiHMJQ+2ZQgQvGoFcC
MD5:	46A2DE536918E78228AD39F6C9BCED54
SHA1:	BD29519E8B65591AED18ADC02A3ED6C8354000A8
SHA-256:	D0E96C1281514494C432A9DCD3059ED824047ABCF10AD228C6BB7AE7C7D58C0B
SHA-512:	5C90FDEDB841782659E9C0D109C0765930362AD1A72F1BA9FAEF155552F35CE364DD783C72CB640509693FF6C40C4E3ABAFA11E301EDDFAA411F3A35B01BB3F9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............8....PLTELiq......{..................'{..}........\|..}..y........py...6....................X.v.....k.....?.....V....w..r{....r~."u...............^.......G......................X....L...................&.....n...?y...B.......q..r.dx......s.... h..=..o.,i..h....j.Px..m..:.8e..j.<{..:....p.At....k..=..E..]..........W.....;........;.......:..................s.......t.............=..........:................w.....{...........r........~..f....,...n..........5.......2...V..k..\...n...a..M.6..q..k..\|...E....f..2....^..............~....b...u.H...f....%..:\|.......X;e....A...5b..\cc..A O....Ot.....N.voU..M3[..#...3#I.4Qx...FWj:..M....%......z@........9.........RLk.gz.........."C......+..$..i............(c.o.{ .p...v......>.3....tRNS...@...... ...7,H........'...........T}.e...?,}...H;s$^.Ga.K{.I.Ui.5Va.....~...l..s............c.....k........................................................................

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360581642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&_fplc=0&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=1523317164.1705360584&sst.gcd=11l1l1l1l5&sst.tft=1705360581642&_s=1&sid=1705360585&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=19904&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3073), with no line terminators
Category:	downloaded
Size (bytes):	3073
Entropy (8bit):	6.028030255644258
Encrypted:	false
SSDEEP:	96:wsbSUtJfxrqLWWWdV6j1XdElRg+qMjTNmRM:JrPWwwCv5YM
MD5:	6DC858628E85671D6826E7A507ADFD03
SHA1:	5B5CDD2E6E2F207AED5683FA9035724167CCBD52
SHA-256:	08D5D3DE5EBB4E2F7A3C6F674E2FE1EE6968BAC45F692EFC0864FC4E2756B47A
SHA-512:	B4AAC9A15292E309ADFBC7541786F0CACB553F4444DBCE8B1BEDD488D0BB9A96830020AF292D0CE468D6CBDFD9D44F5C2C0484F9744D2F4178AC52719E13B799
Malicious:	false
Reputation:	low
URL:	https://www.googleadservices.com/pagead/conversion/988382855/?random=1705360583361&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1705360597967&cv=11&fst=1705360597967&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	dropped
Size (bytes):	65913
Entropy (8bit):	7.971307226627467
Encrypted:	false
SSDEEP:	1536:9vW7pKpv94/eYULcKq1l4dZjq5PYQa6WveFzOy9yJ:9gpqLcQq9YQ9WvOOF
MD5:	C88841AB244771406A1E494DA906DF08
SHA1:	0EDCAA4C1AB9DB7288CC1C893B4672EFEADE4022
SHA-256:	74F172D0322ED8D5A426F2966E4A814D321837FFBE589EEE38FDA77292ECBBFB
SHA-512:	D44272998071A09FB9D04D4BB0B54E06EE60850901F2304209DB5BA0FDA7E5212572D5F52EF43E5ECEC6708013E45550C76CFEAFCB9BF0C7559904FD2826C66E
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..1......%.P!(...J....J(...IKI@.4...@....4.i...4.Ji.SM.'.M..i..i).z.!.%)....IKIL..4....Jq....IJi).i..RP.i.8...m!..4.!..N...JJZJb...i........m.)qIL...R..6.\Rb.....(....IL..Jh..&))qA.......%!.SM.6..z5..lb..d*.F..v..,dn.......<._..j...~..K...}7.:....qR...Z;.0.y...o\|...N..k...[P.:t.~.j.8?}....}k.5..N...M.....J.A.....eY.@x......?S......);.ln_../.......W..s.

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	124312
Entropy (8bit):	5.368835617873961
Encrypted:	false
SSDEEP:	1536:DbRMV4Rdxeo/0PXTvdnzW8kvl+Q+bleEUFIuKhpKhq:fcocXTvdnzW85HeEUFu
MD5:	87F71169401FA4A8937B2720A3C36608
SHA1:	1C9D7A843BFC3EE2531F092DFF8625430A8D74E9
SHA-256:	00A8EAB62A33A1DB93E8CB1D8BD81BC6B2F2BAB681223292BE08CB2703DA5E59
SHA-512:	55F4A6D5B374400AA69AF3E730BA417D3AC36DD5C99BDB2916DD74064FB58E880954FE96853D6073F60FD748556455F450B2440D518888A77732314BEE55A13C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.raf={loaded:!0,run:!1}),B.define("component/referral/floater",function(e,n,i){_i_("44d:439cb7dd");var r=e("component"),a=e("ga-tracker");i.exports=r.extend({init:function(){_i_("44d:bdf88b61");var e=this;this.$toggle=this.$el.find(".friend_landing_collapsible--header"),this.$toggleIcon=this.$el.find(".friend_landing_collapsible--toggle_icon"),this.$collapse=this.$el.find(".friend_landing_collapsible-action_button"),this.isMobile=this.$el.data("is-mobile"),this.toggleCollapseClass=this.$el.data("expanded-class"),this.toggleExpandClass=this.$el.data("collapsed-class"),this.isCollapsed=!!this.$el.data("is-collapsed"),this.isCollapsedClass=this.$el.data("landing-collapsed-class"),this.collapsingDisabled=this.$el.data("collapsing-disabled"),this.collapsingDisabled\|\|(this.$toggle.on("click",function(){_i_("44d:db6abdaa"),e.isCollapsed?e.expand():e.collapse(),_

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10601
Entropy (8bit):	7.952829040090789
Encrypted:	false
SSDEEP:	192:mgDag35PTKU4bA9efpLxOrbnaaDyYPf+CZ1xOqPpXhk5J5CK77mycG3Bl7AZMNe2:3D/PTa1xNOXnaSy5CvxzpXhwjCKp3Blf
MD5:	33BFA10DC5BC4EF8339BD5ABEB8548EA
SHA1:	957C2B9E899E2520A2C97F21D638FCA030DA5A43
SHA-256:	0380753C60C2FA8BD19A5346B32E08DD50BE778FA3D850147638EB16C16BF0B2
SHA-512:	5EFA5E2FDED0BDAAB75AD6AB876FF35A3EAEAAD257E6BBFDD0E2F0D6789FD7D927E13F34CDFA3E4674F3062DAF2016F954D6DDEF4EBF1F21C6643A2E12D85BFD
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.J...F.\.&.3&..I.5.2U)S.M.....9o.F.$Gj..@..w..k.eb.We..... .S...{R.^N;Q..W..cc.FGqZ.4.B.....<..8...}...4.}C../.5.1.2;`...^.../.D$.n2:...EGd4l .........E..}......B...0...Ee.<....]........\\|@.....t....k....c[......;8'Fx.....ITm.\|.Mm..n...M>.K..w...VO.......G..ci.bp.`..\...0..{xA.9.\4.=....ZP...'...p?:..5.v.&.4.o}'.8..u.......:........*O.W.P.;r..

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57572)
Category:	downloaded
Size (bytes):	583161
Entropy (8bit):	5.38380900638552
Encrypted:	false
SSDEEP:	6144:MEcYROiSTxIDs/kTdur2a2b242OwiNXpLquWTRD6Qz4q/n0UoxQwNoVQNQHVntiQ:MXYM/CDPbhSD1l9T0QHVJ
MD5:	7915964D173CDBF22F5A808C28DEDD36
SHA1:	C273706DBAD935F0D0F5FD5B98BD1E6EF5657546
SHA-256:	5644CAF3E48C3AC4FFF8AFA3720F8DCD90C677547347700D25C48F68FA32394A
SHA-512:	46B46D3422A03DC08FE29A6BC82F5731AAA91A4E686CD0D441D9AE6266BECD039317EB1762FB1CC331710D547062FB11B7F34F1ACD1D3B0FCC309002867ACFA6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/main_cloudfront_sd/d28523665f62421e5c65b8c6fc6848b561f4e4a2.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function calcage(e,t,i){return _i_("3da:f8784014"),s=(Math.floor(e/t)%i).toString(),LeadingZero&&s.length<2&&(s="0"+s),_r_("<b>"+s+"</b>")}function CountBack(e){if(_i_("3da:732c2356"),e<0){if(document.getElementById("cntdwn"))return document.getElementById("cntdwn").innerHTML=FinishMessage,_r_()}else 86400<e?(DisplayStr_days=DisplayFormat_days.replace(/%%D%%/g,calcage(e,86400,1e5)),document.getElementById("flash_days").innerHTML=DisplayStr_days):document.getElementById("flash_days_wrapper").style.display="none";DisplayStr_hours=DisplayFormat_hours.replace(/%%H%%/g,calcage(e,3600,24)),DisplayStr_minutes=DisplayFormat_minutes.replace(/%%M%%/g,calcage(e,60,60)),DisplayStr_seconds=DisplayFormat_seconds.replace(/%%S%%/g,calcage(e,1,60)),document.getElementById("flash_hours").innerHTML=DisplayStr_hours,document.getElementById("flash_minutes").innerHTML=DisplayStr_minutes,document.getElementById("flash_seconds").innerHTML=Disp

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5978)
Category:	downloaded
Size (bytes):	578467
Entropy (8bit):	5.9433857827256285
Encrypted:	false
SSDEEP:	6144:Pm6GsvoSIeOzl7L7CM+7t4lEupLR6tpIj8VYufl9C6tkDuzHhQMy+QT:P8F7HfS/4
MD5:	B7170972DE5F8E9134117A40AF88C933
SHA1:	5CEE0EEB6C3D70EFBDEB6B0B3A58A19F242568BD
SHA-256:	D0C9EF38649995A3127E38762B4E6A26589C3EC415313AB778DB44217ED65CBA
SHA-512:	2368B9724F435D461B588575BB6ADA6A1314A6C5974014A62B6495DD8E79AA35F675DAF24265C1AC150675E5D5DA08D666E22690BB1674128B3A5467FE24A19E
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd
Preview:	<!DOCTYPE html>. .You know you could be getting paid to poke around in our code?.We're hiring designers and developers to work in Amsterdam:.https://careers.booking.com/.-->. wdot-802 -->.<script type="text/javascript" nonce="ZSHQjAbC2dgIwrJ">.document.addEventListener('DOMContentLoaded', function () {./*. provides the current user's cookie consent.* in order to use it:.* 1. inline privacy/cookieConsent.js in the page you need to use it..* please note that this library relies on window.PCM.isCountryNeedCookieBanner to be initialised.* before using (calling getValue function) it.* 2. in your js file:.. var privacyCookieConsent = B.require('privacyCookieConsent');.* var consent = privacyCookieConsent.getValue();./.B.define('privacyCookieConsent', function () {.var consentGroupIsAllowed = {.analytical: 'C0002%3A1',.marketing: 'C0004%3A1'.};.var optanonConsentCookieName = 'OptanonConsent';.var optanonBoxClosedCookieName = 'OptanonAlertBoxClosed';.var halfOfYearMillis = 180 24

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (523)
Category:	downloaded
Size (bytes):	2779
Entropy (8bit):	5.256421685296428
Encrypted:	false
SSDEEP:	48:XFZp/sZ3lYQc7ArfSM3eIubF1QkNsKclMtPp/7qgAsFte6NPvD9T5AyNBK:1f/6lGUrff3eFLhNs+G6hb9xK
MD5:	7B430C6350A59A7CF22B9ADECCBA327B
SHA1:	B48D3C289BCB6809BB52FFFD8F013055ED6BCD65
SHA-256:	058ED961BFE422AF7BFC65865F4C08531EC8ACE995F8A1EC560A46581CB7712C
SHA-512:	BBB70E6C0318ED68FC6810E0210D010FC743B9987C6ED15A43C5D308A96A43331B79C3FAB1B39A9034398418FA3321EEC8C51998D79C981E3F511DA3B398326A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/plugins/ua/ec.js
Preview:	(function(){var e=window,f="push",k="length",l="prototype",q=function(a){if(a.get&&a.set){this.clear();var d=a.get("buildHitTask");a.set("buildHitTask",n(this,d));a.set("_rlt",p(this,a.get("_rlt")))}},r={action:"pa",promoAction:"promoa",id:"ti",affiliation:"ta",revenue:"tr",tax:"tt",shipping:"ts",coupon:"tcc",step:"cos",label:"col",option:"col",options:"col",list:"pal",listSource:"pls"},t={id:"id",name:"nm",brand:"br",category:"ca",variant:"va",position:"ps",price:"pr",quantity:"qt",coupon:"cc","dimension(\\d+)":"cd",."metric(\\d+)":"cm"},u={id:"id",name:"nm",creative:"cr",position:"ps"},v=function(a,d){this.name=a;this.source=d;this.e=[]},w="detail checkout checkout_option click add remove purchase refund".split(" ");q[l].clear=function(){this.b=void 0;this.f=[];this.a=[];this.g=[];this.d=void 0};q[l].h=function(a,d){var b=d\|\|{};"promo_click"==a?b.promoAction="click":b.action=a;this.b=x(b)};q[l].j=function(a){(a=x(a))&&this.f[f](a)};.q[l].i=function(a){var d=x(a);if(d){var b,c=a.list\|

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1705360583361&cv=11&fst=1705360583361&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1592)
Category:	downloaded
Size (bytes):	6082
Entropy (8bit):	5.3789708828873515
Encrypted:	false
SSDEEP:	96:1GInbH6vTKvmYDDaLVlLebFNl5rZQlhaPr66PHDf/H4QgG+vylylqn/Dg1judjai:kIn7+TKVDUwZNl1ohanHDf/dw6clqn/D
MD5:	268DEE854A5FC91CBDC18D707EADB7BD
SHA1:	474B436CA52E32A54D498485EB65B94796178B53
SHA-256:	5B116AA0EBFFDFA951A93332424B9B18DCF789F9DF51A495977636D9EFC159F4
SHA-512:	EAFF3C685DC0D922A0ADE1D8FE20BA4F6DA543AAE35C9D9290C1B42186F61DD583CEB1735649D129462B9A8EE863A416F60E22BB724E685659F40CA5048BAED2
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/OtAutoBlock.js
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3814)
Category:	downloaded
Size (bytes):	3930
Entropy (8bit):	5.267050811992827
Encrypted:	false
SSDEEP:	48:qGw21GD4ijjnqHxUZk9WE8H6q/l21GDoA+KsazuIFPGDiILlNaiVH+9QKi+kD:ZwYijDwAzlIhKvzuIlQlMiVHuQKi+kD
MD5:	1A7C523A95596C5B0B122AD8D8E3B553
SHA1:	D5AA6D31940547945F222556B47021E4BE4A8F6B
SHA-256:	9E1C2B43278AF5E8C2F2672EF94438ECFE1C366448A79CCC0C22C837A4AE1E91
SHA-512:	3F212E5664920D72ACE0F8C11CAB56E9194C88CC9BB454A17C2D02DFE3F217ECE2AE27BDA965D79E7E23F9E3F2EFD2EDCC09234973AA07B4E5E66E06053CD17E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/d2a738da.079c3b4c.chunk.css
Preview:	.b4e39ab2ab{width:100%;position:relative}.b4e39ab2ab.aa361a7d23{background:var(--bui_color_brand_primary_background)}.b4e39ab2ab.c68f130be1{background:var(--bui_color_white)}.be2031501f{max-width:1110px;min-height:375px;margin:0 auto;box-sizing:border-box;padding:var(--bui_spacing_12x) 5px calc(var(--bui_spacing_12x) + 30px);position:relative;display:flex;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.a3c3e0e78d{margin:auto 0;max-width:600px}.c9e1121963{width:100%;height:100%;position:absolute;-o-object-fit:cover;object-fit:cover}.rtl .c9e1121963,[dir=rtl] .c9e1121963{transform:scaleX(-1)}.b4e39ab2ab.a1aac51f24{background:#000;max-height:434px}.a1aac51f24 .be2031501f{z-index:3}.a1aac51f24 .c9e1121963{width:100%;max-width:1440px;height:100%;position:absolute;-o-object-fit:cover;object-fit:cover;left:0;right:0;margin:0 auto;z-index:1}.c355246e56{position:absolute;top:0;left:0;right:0;margin:0 auto;max-width:1440px;height:100%;z-index:2}@media screen and (min-width:

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1949)
Category:	downloaded
Size (bytes):	2065
Entropy (8bit):	5.1927602038234495
Encrypted:	false
SSDEEP:	24:04WV/aJCQI27PWV/d1COAKrW+EA+JzAaotdz6C/f2GPpBqB1+TmqT:04aCJvTLa7tbAekC/fnP3qBcDT
MD5:	E66324EF6E0246820FB69426FDB7B8AD
SHA1:	F6A4DF504FD1F1466D86F6A7B1BA87ECB1A65708
SHA-256:	C160F8B64AED88F471F6AF5717654B69C2AFEB7C760695B1B405C80D90ABD7F8
SHA-512:	3060418CA09B91CF3D15B0086DAE7B8057382766A59DD354081E65784DD5084ECF47BB9E9EE36CCF3D4FD5EE2B92B971942F9F9A396E65ABEFA2E3AB8F89E59C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	134
Entropy (8bit):	4.679694954257774
Encrypted:	false
SSDEEP:	3:qTkI9JYkAI0EFw47BFdA+FYBzO9eIJAgRJQgsn:qT1YkC/obXgIdRigsn
MD5:	CF4BF23AE244E6FD5CA63598D4DCC82D
SHA1:	343D98C24A955312CFEFD6BD5947F17E4310EDFB
SHA-256:	C996C0469EF05FF6FDD1F7CEFBC3F7E109BB21969DE42FCF591498A828A7AD5F
SHA-512:	3EC60EE9FF8807A76CB360EBCFA109CB74E586AB981184B4F2C7CEC48E6F14931822501B30B643AA65E8AF419342DE3402F2887802DF8D7717822DA6F50FE0BE
Malicious:	false
Reputation:	low
URL:	https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1705040131734%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
Preview:	<!doctype html><meta charset="utf-8"><meta name=viewport content="width=device-width, initial-scale=1"><title>403</title>403 Forbidden

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46103), with no line terminators
Category:	downloaded
Size (bytes):	46104
Entropy (8bit):	5.3053668132686145
Encrypted:	false
SSDEEP:	768:OaOFhhRDUHahpROfRys3LzQRo4TYYyDMFWPKQ:OaOFnRrRURtzQy4ISWiQ
MD5:	7F75F159026F3A2C8CCCDA487B43157B
SHA1:	021CF5C854DB063CD79BF0394C24EB994E095640
SHA-256:	5E319852607809336B2534FFEB96F6933F26994DD040F535302C84F59CC0A214
SHA-512:	88276152EE25891D16E7B3B28A9B42CBD48D97E1A7D94C1BF5354612603868D5D537D2BA01A4E2F184E6DC6A492B67619D6A7C02DA992AD604F7D0ABEF27A7A1
Malicious:	false
Reputation:	low
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 71 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	630
Entropy (8bit):	7.442406461865354
Encrypted:	false
SSDEEP:	12:6v/7gCbGChpg7/6T6rE3U18KYmNeLg0jFKnoqmhDbxhLUGS+nSASUo1:4hS7/6eo3QYmNuFb9xBUX3ASf
MD5:	63B6187CE089A07D285D837208370F19
SHA1:	A4C2C0BE9A7D2C776BE39ACBDA154846329B42D2
SHA-256:	0D29D4300DBCCC76FE8438937B7F827DFF8EE65767F4CE7168172FE2083B63C3
SHA-512:	AD32C281A7FCF7A0814548578417B01994E31937DC3AC0C73D9CD848F37438C53215E5AEFBF9B44D4076499511D6D3D30BC5E1BD5FEB278B16C14C1BB42FFF21
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Document.png
Preview:	.PNG........IHDR...G...x......B.U...iPLTELiq..U..T..T....!X..T...........T..................U........................5Ly..1$;l.....\ey..........F/.....tRNS...y....q2J..SmoS......pHYs.................IDATx...r.0.E#1T....4....?.CQ...C2B;9O.9..]y.B......@6...@...<.M.@l....pS...l. ...Xx..2....;..7..a.mc.....u9....h.il.A.".`...!.-..d..]_.cO.:.B..9..&...TG..R.....i..r1-E....<.Y...X..i<.{.S.yt...{j.. 6....\|....a..~L...z.S..)W=.....e...{..y.(>....(O=.\|Oy.)g{....{V........l.........0.Y<....9.k......<..$......./g....x....H_+....#.XA_&0....3...5.\U.......6)...u...E.l.x........<...Z..J.o...5....IEND.B`.

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4406)
Category:	downloaded
Size (bytes):	4522
Entropy (8bit):	5.1934697316839555
Encrypted:	false
SSDEEP:	48:Kuhw05qgPm18etDBYWKs7U1g0cFRmdwlGGWXuNaWWHwG6bjP77iyiSikiJPV1HJs:KyBGcso1gnGwldWXuNf1G6bjGZYEWB
MD5:	003B2B00090F78D14ADBD6372657C992
SHA1:	01563A7D481B685D99142AFE00046DE5A3CD69E5
SHA-256:	93CA0CFEE974B27AAAC333437E9A7ADB805CFB6D19DE1FD9FB7C6693495ABCC6
SHA-512:	F30453293DEC0A41AF1D9B9D4613A92917107FFEB3562F4A19881442F890A544E08330A1C92525C7FE939CA4AC74F691D2CFCF9CAFECB7AF56D31C1A8CA5BF8E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/dc32f6b7.3591890c.chunk.css
Preview:	.af069031ff{margin:calc(var(--bui_spacing_3x)*-1);padding:var(--bui_spacing_2x)}.af069031ff svg{height:100%!important}.a8788abbae{vertical-align:text-top;margin-inline-start:var(--bui_spacing_2x)}.d2c0094da9{color:var(--bui_color_foreground_alt)}.fd740c4ca8{display:flex;align-items:center}.cd25237414{align-items:center;display:flex;margin-left:var(--bui_spacing_2x)}.a725c56ef4{display:flex;align-items:center}.ad161903fa{align-items:center;display:flex;margin-left:var(--bui_spacing_2x)}.a7cfd67d6d{display:flex}.cd1c86fdc1{margin-right:var(--bui_spacing_4x)}.d6743a6f92{display:flex;flex-direction:column}.c5bdd0072e:not(:first-child){margin-top:var(--bui_spacing_4x)}.eed9981066{list-style:none;padding:0;margin:0}.a1e3e96425{margin-top:var(--bui_spacing_4x);color:#6b6b6b;font-size:var(--bui_font_body_2_font-size);font-family:var(--bui_font_body_2_font-family)}.ea1163d21f{color:var(--bui_color_foreground_alt)}.bc6c5feac2{text-align:center;white-space:nowrap;width:var(--bui_spacing_6x)}.e8e8

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x798, components 3
Category:	downloaded
Size (bytes):	45764
Entropy (8bit):	7.92397187625578
Encrypted:	false
SSDEEP:	768:SUjFjowoptfEN6iBsg+FzXOisfo0ABhW8S0Io9/cnhXPXOmOPEN:SUjFjIpt8N6iBsg+Fz+isfPAO81+xPjJ
MD5:	389F437A3BC267BD2B48BCA42AB30E1F
SHA1:	EEE01B0C154EE7EEA8628E5B6C001AFB71E2F4BC
SHA-256:	10CC90857D634DD1751A441B4D1E091A183225BF8D7A90D1B71BB0A254B8A8C0
SHA-512:	D3F03F2C0A4272CA18651B60DF3BED2921BB2643FEE055A216F18C107DCFD2F4FE87AC1BAD848E042DE3ABC4EFB6FBC683887CDB7880F8CAF18BC3EE28D4D22E
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/cdata/joinapp/meet_patricia.jpg
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C...........=)#)==================================================........ .................................................................................<;.........................................................0......@....................................................(..........`.............................0.......@..... ..........................................0................!...................................@..... P..@0......@................................................1...........C..0.......................... ........ .8.....!.....0........................!...... ..........,...K.]2B....................................0.....@..q..5...P.cQ....Y........0............................`......J....\|.gX.D....2jE#Z#Tm;Yo..LY`......................................b.*....e.sUg...(.c}Lo.......c].gs....DDc..c...................................ZO!.P..Y..B...WWgZs..o...\....H...

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x500, components 3
Category:	downloaded
Size (bytes):	45792
Entropy (8bit):	7.974352553118242
Encrypted:	false
SSDEEP:	768:FFevOGtlL7ksEysW87ScfhjFUe6maghjlsu+Ij+y2IX7Mfy17t6tiheoPB9zwQWU:FFg/tqsEysWBcPUtmaQlsuPj+VILwyR/
MD5:	0333C11DE7B88C4FD1D534D2C0BD59C4
SHA1:	C924AA1DF20B7E1EA8E642CFCACA476088B0EF9E
SHA-256:	5E9A16504FA6E4B9605B63B630CD686120A88BAAD5AB03A9F4BD788479F808B1
SHA-512:	39EBA832DCC54FB6E2629FA8F0F7D4D0CEF7D238BD7D5776141A25F1F6CD0AD2F20A76BD0C95B02EF3B0891B9099B55FDC07C20D69E5A09516B2D572C36D3253
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....K].lh7m....j.GZ..... 0,.... v.v...\......d..Y.z...p]T.T...V......u%.....:`..A$...Z......<..T. ..Z......B........;%.1..-.e.L..+4...]....X./.%\$k.s^..@..\|h...\...1...#.{t>...(...].i..bx.y...W....Z....k0.T5......._..F.t....U5.M..Gf^..>.jK....u....b..?.mx.........k.l.O.$T-.kbk...O...x.\|~g.3...d?.W.Y.<g..w.l....{..6I>.5.>#:...x..~'....\...j..G..O.m..R..[.

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1041024
Entropy (8bit):	5.384478891555847
Encrypted:	false
SSDEEP:	12288:a+sKvr1FYs3ydRdOjTX8LYz5Z6QanPRGUbdDyRX+h:a+sor4sidzOUY0RGUbdDeO
MD5:	A4618794D329C0C74897C7E2128AA1CC
SHA1:	1B3B6657F5B7C033A22A191D4E8050BA8F54E063
SHA-256:	8D3E09AAD6E323C885AE3815A0348FE5082CB41D6DC843309E201AA275105DF3
SHA-512:	45A043D77B26A8848506707ABA1E86D18E6E8F34127A27032D6456E42D2AB509274D96A49164B22A80449E115F45D0D5B0ADBECC078C6AE82E25C52C70DC0535
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/client.923775ce.js
Preview:	/! For license information please see client.923775ce.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	387
Entropy (8bit):	5.5804556044803775
Encrypted:	false
SSDEEP:	6:+m2FfPp1JQ2FfPp1JLr1kQ1PFh+5apPZT37h4pIoauwjNiVV:+m2Ffy2Ff5qKm5IoauwJiVV
MD5:	C597A946DF70AF95F9F6FF69F1811664
SHA1:	F5BAA53E9C27D3E01468D660EF1275B6E60ECB2A
SHA-256:	FE46D8B4BA168705C0FF46A1F6F5D24454B996AFFA87881AE768666F58B37A0B
SHA-512:	A82316527804EAD77E771E2064D8763922DEF2EBA81418D44571EC6ADEBD56382FFA4C47FECB60D993C21CBBE72A89ABFDA7517D2052597447CDED4A043F2B40
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/697d5684.349d4aeb.chunk.js
Preview:	"use strict";(self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["697d5684"],{fe905f7b:function(p,_,e){e.r(_);var a=e("540adcd8");(0,a.serve)((()=>e.e("c8a2f0e8").then(e.bind(e,"64b778ad"))))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/697d5684.349d4aeb.chunk.js.map

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2323), with no line terminators
Category:	downloaded
Size (bytes):	2323
Entropy (8bit):	5.888394380415764
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08rW/AiS7tzYigl56:wsbSUtJfxrqLWWWdV6j1m/AdH
MD5:	95AD0A7905C4C64C32FC6392A575853A
SHA1:	3B7415C2D1B45692450125C500608C73F26F240D
SHA-256:	1EBDFFF563D5E0BC20A192573484AC960FED08CBE87BD760143ED1BB79F3272A
SHA-512:	7475CF607FC5A81156138722621717C07FBA0633BDE4E613553A2C05B7D4198D626395C781089989CA9C9F55F685A97278836CB873FEC7FFFF351254C6B48766
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1705360583943&cv=11&fst=1705360583943&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107030
Entropy (8bit):	5.305213527068613
Encrypted:	false
SSDEEP:	1536:A3k/BjkmG++IuCbxqMHs3UM65ABPkCMCcX+ePeO/cR/wSlYRFT41O17B:UkOIuCb3s0bhX+ePeO/yY7UQ17B
MD5:	C19666DB7402BDB160C23D93BE3B96D9
SHA1:	F54DC4F577931D125F52A944344E20D633A58668
SHA-256:	9716D3AB4561316887DF7D4CE7E2919A8CD1CED0BF9A94ED33BA31A6CB1AAE7B
SHA-512:	8B0F03533ABDF1F97EA3A12ACCF2CB6644C2C7D4B9FB3F629CFD41379146438713DA956B4992E6984B47A2DDAE6ABA6C9A7B2E9435F4E67B93A3231D99536AC1
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	4.779556032272484
Encrypted:	false
SSDEEP:	24:hYNspeCCZkpG4MEq7agcn0LXTF2FI6nQtSn8nwz8Xx:vp6B17agCwTF2FIhx
MD5:	5CB21AF9462C02E692A749F65C6BDC29
SHA1:	8C3D1ECB7828B84DD6FF6AC417EC40CD4A4635B2
SHA-256:	9AC4888FBDB2C888E034D44E7C40F6F9BF57C6192BE62E94F00782B82A9E33FD
SHA-512:	2C173DA7887DFA62B94CF561A643724D3496118FB5EE02D8FAED1F569F5EA136110469D5CA78180D4AF53C9431BE21B323724C5C4EA45D982FB5D193683994CB
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>405 - Method Not Allowed</title>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="stylesheet" href="https://r.bstatic.com/libs/bui/7.3.1/bui.min.css">.<link rel="stylesheet" href="https://r.bstatic.com/libs/calango/0.500/bui.css">.</head>.<body class="c-body">.<header id="c-header" class="header">.<div class="c-header__main">. <div class="bui-container bui-container--center">. <div class="bui-grid c-header--top">. <div class="bui-grid__column-3">. <a class="c-logo__wrap" href="/">. <span class="c-logo__type">. Bookings_Web_Accounts_Portal. </span>. </a>. </div>. </div>. </div>.</div>.</header>.<div class="bui-container bui-container--center c-main-body c-

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6610
Entropy (8bit):	4.800246623550685
Encrypted:	false
SSDEEP:	192:FnF7pSdDHj3uRCwpY6vepSdDH34w8psdXH78WaJcB:vdwDHj3uswpzowDH34/2XH78WaJcB
MD5:	E36A9DECC7446396FC5979FBB772B1E8
SHA1:	0897A5B166218946D4C2FC59C61DF0064DB540CE
SHA-256:	4F17CA2398E3D9A723DB002D6410192EF52AB2DA7205B845E96F2A255566C165
SHA-512:	C4681065926E9ED54569A230F006CDB2913C8C2DABFCA68A8D8523E8E54E1FA88EEC93AE255F699750744BBA04AA375E610B6C309BF6C1027C4A596A0998BFE6
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea94870-d4b1-483a-b1d2-faf1d982bb31","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2794), with no line terminators
Category:	downloaded
Size (bytes):	2794
Entropy (8bit):	5.910722034380701
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08XIBmitzYigE3KTz/ZbmgB7:wsbSUtJfxrqLWWWdV6j1TITlKTzMko6
MD5:	5E7ADB94309AF3F7BC57D65C2E7A466D
SHA1:	4F23EE2C734C235105D416B53471DD5971F84566
SHA-256:	94BAA1F053F42126E9AFBCA22F03745E5AFC614C2AE2CF048A8E952D7F849D44
SHA-512:	73F54D40179223C31259B7FD14C7E1C3ED913167828B142674AA7D96089F5166D5D015FE3BBCDA46F7020E53D6DABD0F3FFA39BCC8C4E46F56BB938861FC8A05
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1705360583869&cv=11&fst=1705360583869&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1002), with no line terminators
Category:	downloaded
Size (bytes):	1002
Entropy (8bit):	5.701644045708987
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEzn/PqjCC5zqinzYjnpRnLxR2+YI:YyLVkczEzAEzmYnbuO
MD5:	ECEE2E29DD00A24FB536CF681B6D2FE2
SHA1:	40BC0B3B8D7BC13A5A7186538737144E0B02AA5E
SHA-256:	A4BDCF773739389E5154C8E46A2EBEF93B1E618BE8E742CF6BB171B3AAE0E4BE
SHA-512:	A02B0637C37B484075F4D293BACF6620DA01C64D3C52F69B1CDCBE5FD8674A3E05E1255A1E691BB3687E27CE258FCEDE4F08EECF35928BFCF7E9108262FC61DA
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1705360607860&cv=11&fst=1705360607860&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}</script></body></htm

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1705360598042&cv=11&fst=1705360598042&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0
Preview:	<html></html>

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10673), with no line terminators
Category:	downloaded
Size (bytes):	10673
Entropy (8bit):	5.399790184834529
Encrypted:	false
SSDEEP:	192:0shLGV0V1cxG18XIQvN4zawzpNMbiR3XqhmXBKMK+ufNe:0CLGVc1mG184Q14zxpkD8XBKNxfc
MD5:	51BB9219647A94E2D459B12795065182
SHA1:	0BECE94E156322E0EF450C37ED6A8908190248C4
SHA-256:	AF156ED875CD4DC98387C28D1BCEBB5D24E53465025FA0E64F47AB0D57F81BF0
SHA-512:	FFAEF5DC67753FBE990F613E53FEAB06DFDEC428F6E2CBED2A28B13D04C7F45F5A133078BDDA8C3225BFA7A35AD37A16763FC2AB04B812839EB8CF1E2BD7DA7A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js
Preview:	!function(){var n,e,c=!1,p={analytical:"C0002%3A1",marketing:"C0004%3A1"},i="%2C",a="bkng_wvpc",t=(-1<(n=window&&window.location?window.location.href:"").indexOf("/")?n.split("/")[2]:n.split("/")[0]).split(":")[0].split("?")[0],o=/booking\.cn/.test(location.origin)?"booking.cn":"booking.com",r=t&&t==="www."+o,u=/\.(?:dev\|dqs)\.booking\.com/.test(location.origin)?"account.dqs.booking.com":"account."+o,s=31536e6,w="function"==typeof XDomainRequest,d=function(){var n=document.querySelector("script[src='privacy-consent']"),e="3ea94870-d4b1-483a-b1d2-faf1d982bb31";n&&n.hasAttribute("data-domain-script")&&(e=n.getAttribute("data-domain-script").trim(),r&&"87b85d0d-3ef2-4e5f-8f3b-5310072d545d"!==e&&"f2c56a5c-067b-4461-b2cd-c837c9f13afa"!==e?e="3ea94870-d4b1-483a-b1d2-faf1d982bb31":"3e90b6d8-de01-4c76-bf9c-161744d4f2f3"===e&&(r=!0));return e}(),l=(e=document.querySelector("script[src='privacy-consent']"))&&e.nonce,C=window.hasOwnProperty("otStubData")\|\|d.endsWith("-test")?"":";domain=."+t,_=

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://secure.booking.com/js_tracking?ref_action=help&ver=2&stype=1&lang=en-us&pid=6880a3b6d76d00c5&ete=&etg=&etcg=&ets=HMbIWWPaDMRJLYZET\|1,HMbIKELcdEZYHRYKe\|1,HMbBaSFbeAFDCaceNTWYcMSPRXe\|4,HMbBaSFbeAFDCaceNTWYcMSPRXe\|8,HMbBaSFbeAFDCaceNTWYcMSPRXe\|6,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,HMbBVbXbTYJKSCHe\|1,HMbBVbXbTYJKSCHe\|2&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	107030
Entropy (8bit):	5.305213527068613
Encrypted:	false
SSDEEP:	1536:A3k/BjkmG++IuCbxqMHs3UM65ABPkCMCcX+ePeO/cR/wSlYRFT41O17B:UkOIuCb3s0bhX+ePeO/yY7UQ17B
MD5:	C19666DB7402BDB160C23D93BE3B96D9
SHA1:	F54DC4F577931D125F52A944344E20D633A58668
SHA-256:	9716D3AB4561316887DF7D4CE7E2919A8CD1CED0BF9A94ED33BA31A6CB1AAE7B
SHA-512:	8B0F03533ABDF1F97EA3A12ACCF2CB6644C2C7D4B9FB3F629CFD41379146438713DA956B4992E6984B47A2DDAE6ABA6C9A7B2E9435F4E67B93A3231D99536AC1
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://22b7de70070b66a71431259564d59756.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16450
Entropy (8bit):	6.0158867265632345
Encrypted:	false
SSDEEP:	384:LW26QW0R1HcPLhZvYQbc6IsnU+MItHx05ePKgDNA6+VXF:i2hL8vDzPUlUPG6u
MD5:	C81C0C5BF9EB5BEE85605F6CD8254C76
SHA1:	BC4D102EEBDB5C311202F451ED4C7DB54D959804
SHA-256:	66F5E9AA76E7FF11F67AD14987D9E064B6A5C54F79FE1E8A3802474B66FB4030
SHA-512:	E5BAE75457EDA1B0A3CFCFEAF9FA6C3F3CCDB07CD3A81ED9EB34112D1443836E40777EE0D8D9E215123E0FDB893C866243679F828EA77D3450AB673B13184434
Malicious:	false
Reputation:	low
URL:	https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202401080101&st=env
Preview:	{"sodar_query_id":"4LylZZLrB93sxtYP8eaDoA4","injector_basename":"sodar2","bg_hash_basename":"MCFrRHZE15CKjvM6RLwmjguI7mqh03m56A7oA9GJNi8","bg_binary":"tYByAv3vCd2WM4vBWZu4W+fobBq4Z0zA2CiRrplFMv7Qqc3O8iuwAiL36BS/nWFGMIdoI3I6ylnCRuY2AFjm6c58YON1HfzQeJxwS9o6otHgnx+6BcD1O8LCG88sgk6Gk0Yszqi9DOrVnt6GcJGOS2sCuYXjHJC+871yDTTukyN/3A305ltR0BXeNdmQV+Ls6iTMSceZGURZijM4t8UgTlNSVVJOuil7zGkzXAgZzVOcEgi+jtDaQDG0+L38Z+5FR0oZAfrPwNi1I7+VEiY9B6VANz0bUD8ROFGPhKzTv47Ls3vwfTTXokU2d+yla47dfApQyphX5gKDivXnhV+yWuCXox1dnjt/B21hEWuRkZ4P+Y+53BzRWdoxHj29mD4gWDBBye3a2gim5l9SZs/N7UqYKXgOARgqm+ORQ5Pdncp1ES41f7V9zT2P6uCqxo9PR/dsZUBuSLh+E6zmKvPI2YTaDQoGuPsE8/cjlqySzER+AL+oErk7JGPY/VQQHfT/PYVS6UmO4ZkPyD6PLyHbfKxumyGxlhpjjZNquWyD+geNlUPCV43PnOPH7u2Lejwzlk44hYu0+KyfmcdlsCf11CN4JlQW2Ucx4aGpzkH1B32RZaRfxinw7nyymMETtrgFUI5a9ykmssVRKQyJx5A0qWZZp7PhE1VR+Jeulqy+XdRxDR/72ivAPF033luZfK88UxJYJV8IhwpGgINYQ2TYCKjFIr1Ktam5H9Tlrzr3J4tbu/CmAhbLuDsHcWjEPiBAGbCXEVUn7LoUJQe1ptRU8VRStrnsFz0tLvNOVOjYaOO4qm36St3ITXqd8XmC9JekY5uVHKmA/qjmqu0lb

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533), with no line terminators
Category:	downloaded
Size (bytes):	533
Entropy (8bit):	4.933115570682282
Encrypted:	false
SSDEEP:	12:X5eNcBWFXMOYEBAP5egtIzVWRwHjXJqIK+qIKzg0fUsq5eK:pemBkXWegazdDZq3+q3c08sceK
MD5:	FEB698008C36A09DFE88AB06A1C3E3B9
SHA1:	A871FBCBBE298AE7078D06627708B2C106A0FAF3
SHA-256:	1C4E7E389D73C6ACF7F19CC812514E71230740791FDE8A018C1D7EDCCF1590AE
SHA-512:	F8E3CA3E49B1C027232D1B3AAB82B5430F4A69334A5E18BEB4469C39D6A24D3F4D3FA4C473F360B619CE734977F0D7EFD03BE6ACB5EB7B9F69295FB2CBF94D9B
Malicious:	false
Reputation:	low
URL:	https://accounts.google.com/gsi/style
Preview:	#credential_picker_container{border:none;height:330px;position:fixed;right:20px;top:20px;width:391px;z-index:9999}#credential_picker_container iframe{border:none;width:391px;height:330px}#g_a11y_announcement{height:1px;left:-10000px;overflow:hidden;position:absolute;top:auto;width:1px}.L5Fo6c-sM5MNb{border:0;display:block;left:0;position:relative;top:0}.L5Fo6c-bF1uUb{-webkit-border-radius:4px;border-radius:4px;bottom:0;cursor:pointer;left:0;position:absolute;right:0;top:0}.L5Fo6c-bF1uUb:focus{border:none;outline:none}sentinel{}

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54111)
Category:	downloaded
Size (bytes):	194024
Entropy (8bit):	5.162938616611763
Encrypted:	false
SSDEEP:	768:Q51bgyTkph/rF6lavvawlUGvBMAbrU7r6SK3vo1W0hjXhDC5XEtgjapTIuIc29ZL:Q5rlavvawlUGvBMYQQBiUGs/XfdfpR2w
MD5:	65ADF2D4363BBA13D63BBC403B0B3CCE
SHA1:	B832E79A018E9663A0AE9B853670593665BE821E
SHA-256:	A36B654FA18C92921473C42EA034CF22F73028D1B6CFFCE6300EBAF035E50700
SHA-512:	1DA490133237FEF70684AA17AE9931A1F506F9D27FD8382CD0A6FCA6119938974806C134B7CC55AEF2B38839017A7446CA52004E59C67EBBDC50BAEF0AC7DECF
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/client.c9e8f1b3.css
Preview:	:root,[data-bui-theme=legacy-light]{--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#0071c2;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#c00;--bui_color_constructive_border:#008009;--bui_color_background:#494949;--bui_color_background_rgb:73,73,73;--bui_color_background_alt:#f2f2f2;--bui_color_background_alt_rgb:242,242,242;--bui_color_background_base:#fff;--bui_color_background_base_rgb:255,255,255;--bui_color_background_base_alt:#f2f2f2;--bui_color_background_base_alt_rgb:242,242,242;--bui_color_background_disabled:#d9d9d9;--bui_color_background_disabled_rgb:217,217,217;--bui_color_background_inverted:#171717;--bui_color_background_inverted_rgb:23,23,23;--bui_color_accent_background_alt:#fdf4d8;--bui_color_accent_background_alt_rgb:253,244,216;--bui_color_action_background_alt:#e4f4ff;--bui_color_action_background_alt_rgb:228,244,255;--bui_color_callout_background_alt:#fff0e0;--bui_color_callout_background_alt_rgb:255,240,224;--bui_color_background_dis

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (647)
Category:	downloaded
Size (bytes):	514678
Entropy (8bit):	5.669850658889447
Encrypted:	false
SSDEEP:	6144:58+cCxHn6/Wk+Zx1raepBj8oQHOlkjc7n/NrfQjFw/hrPutvvQmkUtV6:5/bZk/ShQumirfqFw/MKmkUK
MD5:	37C6AF40DD48A63FCC1BE84EAAF44F05
SHA1:	1D708ACE806D9E78A21F2A5F89424372E249F718
SHA-256:	DAF20B4DBC2EE9CC700E99C7BE570105ECAF649D9C044ADB62A2098CF4662D24
SHA-512:	A159BF35FC7F6EFDBE911B2F24019DCA5907DB8CF9BA516BF18E3A228009055BCD9B26A3486823D56EACC391A3E0CC4AE917607BD95A3AD2F02676430DE03E07
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. o

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CICOv7fD4IMDFZMKTwgd1vwIQA;src=11963210;type=partn0;cat=partn002;ord=1;num=8854309224855;auiddc=*;u1=us;u2=en-us;ps=1;pcor=417670551;gtm=45He41a0v864019428;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2;~oref=https%3A%2F%2Fjoin.booking.com%2F%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26lang%3Den-us%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%26utm_medium%3Dfrontend%26utm_source%3Dtopbar
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	5.372970099285801
Encrypted:	false
SSDEEP:	48:Nqretq4wIZK/SB5db6yi/HIRyIzbFCls+7swuJqIKavVivHN0:nc/w5fifyyS6s+7swufzY0
MD5:	D7F862620CB2EFA2734845264AF198EB
SHA1:	28B2B818CAFBC67C7D4AC33E54E8EDF63C485D86
SHA-256:	D3C7C4DBE9A235E7BA1DBFE981C2AF6E18B722EF684EF16EB08C4FC2A82A6627
SHA-512:	BD1EF42B0C2110B455DBC489FA65395BF00487F47F2776FA8975E19DA696065E15571819EA61DA5F61C45EDC4A3C6B243E06A357FB381CBACEC63E31CF946BC8
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/cookiebanner.html
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<script>.var OT_CONSENT_COOKIE = 'OptanonConsent';.var OT_ALERT_CLOSED_COOKIE = 'OptanonAlertBoxClosed';.window.addEventListener("message", receiveMessage, false);.function receiveMessage(event) {.if (event && event.data && event.data.OptanonConsent !== undefined && event.data.OptanonConsent !== "undefined") {.setCookie(OT_CONSENT_COOKIE, parseConsent(event.data.OptanonConsent));.if (event.data.OptanonAlertBoxClosed !== undefined && event.data.OptanonAlertBoxClosed !== "undefined") {.setCookie(OT_ALERT_CLOSED_COOKIE, event.data.OptanonAlertBoxClosed).}.}.}.function getCookie(name) {.var nameEq = name + '=', ca = document.cookie.split(';'), i, c;.for (i = 0; i < ca.length; i += 1) {.c = ca[i];.while (c.charAt(0) == ' ') { c = c.substring(1, c.length); }.if (c.indexOf(nameEq) == 0) { return c.substring(nameEq.length, c.length); }.}.return '';.}.function setCookie(name, value) {.var date = new Date();.date.setTime(date.getTime() + 365 * 24 * 60 * 60

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.241874464925297
Encrypted:	false
SSDEEP:	6:w9NARNMJjQykRp6bXN25xBRZVXokLVEXNBezVL1Eh4pIoauw1cmWrn:qARsYUzN25HRZVXokSXNBezd1HIoauwG
MD5:	D4CB397172A601054D15E416B713F8B5
SHA1:	162C867ED5844026AD8EE199E3FCA6CFFE035D78
SHA-256:	FF95DEF5529ADA643FD4B60EA36B338EC8DDA2F277C4238430CDE9BA13EB89EC
SHA-512:	1B2801D4B9C43D7EDA942C068FC0C079A547313B2CAB681E5D914AAEB5CD5218F1BEAFFC5CB64B46C1A2192FAB7FBFFF1EAE8A74893C5DEC1E91BCAE7267F3D2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/b9a82cb8.c62928a4.chunk.css
Preview:	.fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-line}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/b9a82cb8.c62928a4.chunk.css.map/

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 912x472, components 3
Category:	downloaded
Size (bytes):	80355
Entropy (8bit):	7.655557659776673
Encrypted:	false
SSDEEP:	1536:4gxrR5Xb4CNqFk2Wxjh6FSDMkMaBfxfOnakN5NbXS:4UrRZ0r8d/DPhBfxfyvxzS
MD5:	A53B29DB82BD58CDAFAB840D88D3CEAA
SHA1:	001F1C8675AFB0C0A5C30D6ADC22CD38473C0D96
SHA-256:	08C7078B8DF92B76EACE4002EF24A8221F7B0931B8E8542730C7722CF1982549
SHA-512:	7838572EF05FE35F8E3DD54D010DFAB47BB5CE42ED5E9F93733900F250C4ADA548DB51A75763BDC70F271EC173C944B8078A7BE79BF061562E876D24FF87D5C1
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/simgad/18373004164674760158?
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2327), with no line terminators
Category:	downloaded
Size (bytes):	2327
Entropy (8bit):	5.895591314447597
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08yiE8A3SwetzYigl16:wsbSUtJfxrqLWWWdV6j1LERQ1
MD5:	8DF420C97AFD705C6BCD767C0CBF8DB7
SHA1:	341D1535CCF486EC897691A0F47380A643401AC5
SHA-256:	8B399F913852F4E16DD8968630517AC97DCBEC5B19F0495540C8D2D04736FAA5
SHA-512:	21BA0F740C6AED78898BB0ED0604D8991644C4382F75D0115B8CEA5D391222573BF9716E188DC5B3B1E2A85F4CB115DCF5984C2447E85F3AE525A8B00570C3E0
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1705360597783&cv=11&fst=1705360597783&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	330518
Entropy (8bit):	5.530169348371815
Encrypted:	false
SSDEEP:	6144:suNuy1ZftK0lrRO7whOZ38YP2ao1MYsRovok:swg/oB
MD5:	47728C183EDABABB28231C44F6F5E148
SHA1:	EE28BCE00F1EDAC404A69795C31F16D79A544099
SHA-256:	59B578B40AB9E91B4A59569EEFC63DD209EBCB9E2662CB3CBAE796F9DB262332
SHA-512:	6DA48C795BB366DF4A95BE23345D6B3750D3CD941899BA9777E11CEAC16AC3E25DF3A7279D9F53EC79C55F4F6639507A659A525A6FC413CE5C2FC61EB1983D48
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/dc32f6b7.e488df59.chunk.js
Preview:	/! For license information please see dc32f6b7.e488df59.chunk.js.LICENSE.txt /.(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["dc32f6b7"],{d0989236:function(e,n,t){"use strict";t.d(n,{B:function(){return a}});var i=t("dc6d28ff");function a(){const e=(0,i.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.i

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10601
Entropy (8bit):	7.952829040090789
Encrypted:	false
SSDEEP:	192:mgDag35PTKU4bA9efpLxOrbnaaDyYPf+CZ1xOqPpXhk5J5CK77mycG3Bl7AZMNe2:3D/PTa1xNOXnaSy5CvxzpXhwjCKp3Blf
MD5:	33BFA10DC5BC4EF8339BD5ABEB8548EA
SHA1:	957C2B9E899E2520A2C97F21D638FCA030DA5A43
SHA-256:	0380753C60C2FA8BD19A5346B32E08DD50BE778FA3D850147638EB16C16BF0B2
SHA-512:	5EFA5E2FDED0BDAAB75AD6AB876FF35A3EAEAAD257E6BBFDD0E2F0D6789FD7D927E13F34CDFA3E4674F3062DAF2016F954D6DDEF4EBF1F21C6643A2E12D85BFD
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.J...F.\.&.3&..I.5.2U)S.M.....9o.F.$Gj..@..w..k.eb.We..... .S...{R.^N;Q..W..cc.FGqZ.4.B.....<..8...}...4.}C../.5.1.2;`...^.../.D$.n2:...EGd4l .........E..}......B...0...Ee.<....]........\\|@.....t....k....c[......;8'Fx.....ITm.\|.Mm..n...M>.K..w...VO.......G..ci.bp.`..\...0..{xA.9.\4.=....ZP...'...p?:..5.v.&.4.o}'.8..u.......:........*O.W.P.;r..

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2344
Entropy (8bit):	7.885895023441641
Encrypted:	false
SSDEEP:	48:5qdKL8E2+5H4aj+orbjgcF4cU7f/wEr7BObNyhtvqTRrfrz:h4EzN4aCSjjQf/1rdObzTJz
MD5:	D05A0AB9BF394439A1584A2B0D44DB5C
SHA1:	183C28023D3BA3358A7A5DF1DB887582AE5340ED
SHA-256:	B23272A9692C4EC3C020935917E9D096490876C976ABEC1290BD3CC9AAE13974
SHA-512:	1710604C6F6AB042DE505286DC4A6FA2217BF4126C000A510156E82BA975DEE0818E74DC612D556E76A71753B8285F759D4DB7566799FA72034A3E5EE5305482
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..._...............sRGB.........IDATh..X.l.......`.......K.'m...$...Ti.F..T.JK.4A."QZ...m......B.....B.....,...V....w68.......L.w>....>G.Pr#...{o..\|..{3.X.d..".E.CE.......J.Z.DH19[2nAi...;.X[..y....Q.?m..i...\|.d.N....RU..8.u..y...Ps..n'JE....d.w5..p.o.]..OWt.!..I.:j;....Fg:..+-c.j.6x.....s&........:jIu.'[.:...k?#.,.B.N[I....F.0.:d..e.-...`.GVT...:..,..)./"...8%34m.)c.w............J...ej.&>///....QXX.+((H....[.l.........y.P..z....M.3)b..r.}\.Zc.t.0..N.M1~..dJ..k:o..3AA.........X...........P..O.^ZZ:.q..M..,.0j'.#~..sn....m.++]..E..-..g/.....S..+....x....w\|0.#.....I)_.V..{zT..H...T..@9..b...(Ht...u...J.2...&...8...f...I76..<.....,.iT.c...?....%.....SJ....ZK@+..b)X^&....l.8...V.0]..0..A.3...q.w...r....._.(t...h.j...+.4.K.....4.....G.]I......JJJ.8..I).`._.D"'..`.....hnn....W....9.`)_..i.l..^....W.C.>...-.....i\|.R.....<{xx.....M4....F....#..-.@..h......G.F` .......\...?.1.....l.C[....s?A..?`\......n....G!./IkI.o..

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	2.0935949490559387
Encrypted:	false
SSDEEP:	24:KqH7QNbKDCaVH//zkVKaklSvDBkNothKK1suC8GCODul:fsN+lH//a7iNsj1RGY
MD5:	FAEDFE66CF96784098C9B7B1F405EF12
SHA1:	645DCE7842FA7483BB676DEF6DF255317F203F22
SHA-256:	A87EC2239235E2521BEBE6F92DC4A65CA035FD419EBD09B68D04B989AFD3141A
SHA-512:	26EF8C32AA51607F3A2C8F517D3A7578FB5F5B6D623581D5BDDC54FC458658E7376263D8511147CFC7A3A507DC51E295382A1FFBDE510C59445E6911AAACD47C
Malicious:	false
Reputation:	low
Preview:	...... ..........6...........................(.......(... ...@................................5...M...jC..)...g..........................................................'w...............w....................................................................................................UUUUa...3.......UUUUU .330......UUUUUQ.330......UR.&UR.33 ......UR..UV..3.......UR..UT..........UT..UQ..........UUUUU`..........UUUUV...........UUUUU...........UR.EU`..........UR..Ua..........UR..U`..........UV.EUa..........UUUUU ..........UUUUV...........%UUU@.......................................................@...............q...............w..............wwt............'w................................................................................................................................(.......0........... ....................5...S...jD..>..........................................................w...............................................................UUT`.31.....UUUV.33....

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24437)
Category:	downloaded
Size (bytes):	24549
Entropy (8bit):	5.306818225611807
Encrypted:	false
SSDEEP:	384:lTkxTVqpsUi61OR3YD+64nUPgtHylJW5NAxd+UT1cN53:lTkWB0YzJ7xF1c/
MD5:	7A8679C882AEDBEE4307F162A1998BD5
SHA1:	FE5BC8EAEE9A00661A2E5D45585E9A8F086DB2F6
SHA-256:	04D0E079C14E872103A66C9F830E38A35C068460C77BBDF92A8ABE6474DAF0E1
SHA-512:	1D50C69F3686CAB766CDF9BF6B443C1F279BE539EF9844391606CE9DBFA6D335688CF863AF926D9ABF39B043BD648EF81210C5A2956E624F38C86527918E5583
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/926bcaf3.2af16116.chunk.js
Preview:	(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["926bcaf3"],{"181eacc8":function(n,e,t){"use strict";t.d(e,{d:function(){return a}});var r=t("6ee88c54"),o=t("dc6d28ff"),i=t("d1e54a96");const a=()=>{let n;const e=(0,o.getRequestContext)().getSiteType(),t=(0,i.isRTL)();switch(e){case r.N.ANDROID:case r.N.IOS:case r.N.MDOT:n="small";break;case r.N.TDOT:n="medium";break;default:n="large"}return{defaultViewportSize:n,defaultRTL:t}}},"64b778ad":function(n,e,t){"use strict";t.r(e);var r=t("3d054e81"),o=t("ead71eb0"),i=t.n(o),a=t("dee2534d"),c=t.n(a),s=t("181eacc8"),u=t("90a20ace"),l=t.n(u),f=t("d16e9636"),h=t.n(f),p=t("41c6c66e"),d=t.n(p),v=t("aef1fcb8");const m=(0,f.loadable)({resolved:{},chunkName(){return"components-HelpCenterApp"},isReady(n){const e=this.resolve(n);return!0===this.resolved[e]&&!!t.m[e]},importAsync:()=>t.e("4dfc553b").then(t.bind(t,"c98474b1")),requireAsync(n){const e=this.resolve(n);return this.re

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20445)
Category:	downloaded
Size (bytes):	20557
Entropy (8bit):	5.3247282042405715
Encrypted:	false
SSDEEP:	384:TiWN4wmEt5c8Ff5GlkJ3SCDXuQZFwIXULlWJqQj:TiW2kJ3SAT
MD5:	BF1F8432BA23D6D7DE73ED81680B3619
SHA1:	AD64C725E053702E946A1240846D3351A1D1BEE7
SHA-256:	AFB85A41EA016A67A3060032C1A9DBB7A8A661E698CC7AAE56489F731B0E46C2
SHA-512:	93939FC78A6EF0362FCA538410E1E24EE65D38C260EEF398A087ED598924044A81DA8C1B544CAC6DAFFFF17EEFF1A07F77BCDCBD379F80230659457A05A31DAB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/c8a2f0e8.8981d2dc.chunk.js
Preview:	(self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c8a2f0e8"],{"181eacc8":function(e,t,n){"use strict";n.d(t,{d:function(){return a}});var r=n("6ee88c54"),o=n("dc6d28ff"),i=n("d1e54a96");const a=()=>{let e;const t=(0,o.getRequestContext)().getSiteType(),n=(0,i.isRTL)();switch(t){case r.N.ANDROID:case r.N.IOS:case r.N.MDOT:e="small";break;case r.N.TDOT:e="medium";break;default:e="large"}return{defaultViewportSize:e,defaultRTL:n}}},"64b778ad":function(e,t,n){"use strict";n.r(t);var r=n("3d054e81"),o=n("ead71eb0"),i=n.n(o),a=n("d16e9636"),s=n.n(a),c=n("aef1fcb8"),u=n("dee2534d"),l=n.n(u),p=n("181eacc8"),h=n("90a20ace"),d=n.n(h),f=n("dc6d28ff"),v=n.n(f),m=n("28dbd132"),y=n.n(m),g=n("498cfd77");const b=(0,a.loadable)({resolved:{},chunkName(){return"pages-Index-Index"},isReady(e){const t=this.resolve(e);return!0===this.resolved[t]&&!!n.m[t]},importAsync:()=>n.e("4ff72d09").then(n.bind(n,"7a7316f2")),requireAsync

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (366), with no line terminators
Category:	downloaded
Size (bytes):	366
Entropy (8bit):	4.947938675367595
Encrypted:	false
SSDEEP:	6:mCbRCDNqOVeBg9HSA6bRQsksShvYbRmX5INefwzXTNsRVaLNWR9Ui:mCeNqg6tS/JINefQXTNsDxR
MD5:	A96C17C55697D80E42DA55B51F446A05
SHA1:	8CC207CEF5F093D2A0955DD2DAB19A3146CEE5B8
SHA-256:	5638412E83D699386A4585D3184184E09A3A1F5DA508923374C2ACDED7BDCEFF
SHA-512:	34DF71952B7A51317BE6F1052D093B15F512D7320CD025B1C1D8A6B027FFB292D070252BA0002040858AC6336F158E6EB617CE19D5898EBCBE617A620B3BD0F0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/help_cloudfront_sd.iq_ltr/cef6a9ab3ed133836378c47756fde5816a6a5448.css
Preview:	body.help{background-color:#f5f5f5;color:#333;-webkit-tap-highlight-color:color(#0071c2 a(0.07))}body.hc-redesign-variant.help{background-color:var(--bui_color_background_base)}.help #bodyconstraint{background-color:transparent}body.hc-redesign-variant .help-center-web-container{overflow-y:auto;min-height:-webkit-calc(100vh - 300px);min-height:calc(100vh - 300px)}

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	dropped
Size (bytes):	58584
Entropy (8bit):	7.968304303880018
Encrypted:	false
SSDEEP:	1536:9N7O8cFGyxtSD+wrnTBayfsbenlWTNGjT7bf:3U/k+ATBawURGPf
MD5:	BC97CF66E6D1C4C3C688125085F0B084
SHA1:	4A3895EB2878D0BF2D236B65B6737FFBB375CDCA
SHA-256:	E3BFE1C17CFFBCC8EA82E6CE2F1C1E4ECD92093AB986DF64208B4C35201C4289
SHA-512:	9D0C62048863219698311F6A7A581AB0EFD89A5D42E2DD4BE67B7797DE19F45BAD549DD391FF3E81EB83269129E91CC664490A7101EE3B6D0D917A8A27C8A9EE
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........E.P.R.1@..8.P.E.P.E/jLP.b..(.QF)q@..R..IE.(.(.....R..J)...LQ.\qF(.(..-+..R...Qq....=E?h.ld8....6{.p..)@.&._.....JpZp\R..h.)h.!.&.{Q.zQ..4\4.,SL'.?"..R........V./\|Q...f.+g.PjS..MD.;..d......U2.8...I..L...;`..BV....R..RE.....Gj.....s..tN*Q...S.>.....,.!....x.2)L..0.})....A.N1..~g.&..N.... .......f-.`.. ..)cM.R..T.q.Rf.y.Zb.Oji..QT+.........7i..I..Ni....

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	78
Entropy (8bit):	5.063809750719373
Encrypted:	false
SSDEEP:	3:YMgpWR4blJQ3iWlyg0RYs3PIg:YMclJ9my7RY2
MD5:	CA67029B9A45657D98B0B48A6A26392E
SHA1:	B02BCB844767FBC04ADDED326478B6B997752051
SHA-256:	4DA281F504B703D11E0B40593E71BD332B145A55C18755CBD90751049D0B1A47
SHA-512:	19452F8E278AB4B18DC3D3C1D45CF72376D6FAA4FC5579BF583B71C7DB0D1F6D7B57C695FB717EBCC21E77B4900911F2F05A63936456CB97FAA60063778E0340
Malicious:	false
Reputation:	low
Preview:	{"id":"151","status":"OK","userid":"k-t9nnCUwC227b84Dh6MIXwLUNPlKQxBMtwebN-g"}

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (14527)
Category:	downloaded
Size (bytes):	14838
Entropy (8bit):	5.417543666815326
Encrypted:	false
SSDEEP:	384:Ss9t0S/g8UoDthaNyvhCCIKTKWhKPKiX2BKIQNvyknKlRCLJTeKpW:N7/DLDthj8X22gR8TS
MD5:	D4EB5C6BD0EA61C0347A585B09438C47
SHA1:	F39B4F64763C001A7251A4CCB2C8937D24A6CC49
SHA-256:	C9A726FB5E408C905AF5FA916E23740A283B9AB6F8ADFA955A0B3B40E7C6CDF9
SHA-512:	77CA4789553B34B8E1746F91AC33D7796D7833D32A2DDEF8D0D4D071F1602EE5660FA3F5DEBBE83F53A152A81D27646B25A257FC3195F6A60F39592E38202995
Malicious:	false
Reputation:	low
URL:	https://gum.criteo.com/syncframe?topUrl=join.booking.com&origin=onetag
Preview:	<!DOCTYPE html>.<html>.<head>. <script type="text/javascript">. window.CONFIG_CSM_DOMAIN_NAME = "csm.va.us.criteo.net";. window.CONFIG_CSM_RATIO = 100;. window.GUM_DOMAIN = "gum.criteo.com";. </script>. <script type="text/javascript">. !function(){"use strict";var i=function(t,e){return(i=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n])})(t,e)};function t(t,e){function n(){this.constructor=t}i(t,e),t.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}var e=function(){return(e=Object.assign\|\|function(t){for(var e,n=1,i=arguments.length;n<i;n++)for(var o in e=arguments[n])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t}).apply(this,arguments)};function n(r,s,a,l){return new(a=a\|\|Promise)(function(t,e){function n(t){try{o(l.next(t))}catch(t){e(t)}}function i(t){try{o(l.throw(t))}catch(t){e(t)}}function o(e){e.done?t(e.value

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	153072
Entropy (8bit):	5.568430519720468
Encrypted:	false
SSDEEP:	1536:P0c3FDy/wKcnzKEtPBgjBgQQuIPbwLlZ/Ib8fvcQb72UM8N9:j20zZWy8clUM8D
MD5:	B784A10F3E0A67DE1F039C5DA9307D34
SHA1:	3769D725AD8F548DD86225461B7C6AC68A056C83
SHA-256:	575B21F1324E9E096BD7F3E86F766FECA57D5FE880383E529258C6B4748746A3
SHA-512:	E50811FD50BA876833DFD2E77257911293FB9F45BC7A55277F7AB7C89998F753E7B5396AEAAD3AEB3B39A99AA3CE634123512A521E7D79E1A905A1E3ADF1C72D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/d2a738da.b09ae90e.chunk.js
Preview:	/! For license information please see d2a738da.b09ae90e.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["d2a738da"],{b6ea4fe7:function(e,n,i){"use strict";i.d(n,{Z:function(){return N}});var t=i("dee2534d"),a=i("c44dcb0c"),r=i("8521b397"),d=i.n(r),o=i("ead71eb0"),l=i.n(o),s=i("3679468e"),c="e3c3c86858",u="b11f70841a",m="b72f7730d6",v="b7b171467e",k="a6f35737db",g=i("43bedd84");function _(e){let{ctaURL:n,ctaNewWindow:i,children:a,className:r}=e;return l().createElement(t.Link,{className:r,text:a,href:n,attributes:{target:i?"_blank":""}})}var N=e=>{let{className:n="",ctaURL:i,ctaNewWindow:r=!1,size:o="small",inverted:N=!1}=e;return l().createElement("div",{className:d()([n,c])},l().createElement(t.Text,{color:"neutral_alt",className:d()(m,{[v]:N})},i?l().createElement(a.Trans,{tag:"web_ge_generic_signature_with_link",variables:{b_companyname:g.p,start_link:"<0>",end_link:"</0>"},components:[l(

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605931
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	350175
Entropy (8bit):	5.13262689881565
Encrypted:	false
SSDEEP:	6144:6idI1r1yYDNedS6h8bso0sAaxIe04+7IvttoH7QIPSSC4n1gDLkM:6idISKNedS6hB9e04+7IvttoH7QIPSSw
MD5:	10B7C220B7F23C954973C2D5238E7313
SHA1:	04526A6AFF262A6322F45895DC1B2E1CEC864DB2
SHA-256:	D1A51C5DEBEF06E71DAE660D2E77190FFA2554508C9E6354997A2D86FEF991CF
SHA-512:	768CFD21E9FF5CDCEDB29A6F14D1A61D0A7BFA2064D9E5EA95A0449BDB45508EF7B389F9E39CBD0DA58D3748B26F0FE5E743D29AB33B762AEE07ACC7C711B11F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css
Preview:	.destination-suggestion ul,.destination-suggestion li{margin:0;padding:0;border:0;vertical-align:baseline}.destination-suggestion ul{list-style:none}.destination-suggestion a:link,.destination-suggestion a:visited,.destination-suggestion a:hover,.destination-suggestion a:active{unicode-bidi:embed;text-decoration:none;color:#0071c2;font-weight:normal}.destination-suggestion a:hover,.destination-suggestion a:active{color:#febb02}.destination-suggestion a:visited{color:#838383}.destination-suggestion .tab-content .tab-panel{display:none}.destination-suggestion .tab-content .tab-panel.tab-panel-active{display:block}.destination-suggestion .tab-nav li{float:left;margin-left:-1px;border:1px solid #c8c8c8;border-width:1px 1px 0}.destination-suggestion .tab-nav li a{display:block;padding:5px 8px;border-bottom:1px solid #c8c8c8;background-color:#fafcff}.destination-suggestion .tab-nav li.tab-active-indicator{display:none}.destination-suggestion .tab-nav li a:link,.destination-suggestion .tab-na

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	53586
Entropy (8bit):	5.539492928652157
Encrypted:	false
SSDEEP:	768:A36XlD+tm7nisw8TlfInB3WzrUEABvtiR3/wcJlYRfGkuF3QraRqJyCWrctKCB:A36XlC0TNNdNQbtip/wSlYR1vlJF7B
MD5:	F9A118320C5EEAEAF317CD40F3E7AECB
SHA1:	A74A9FC15452095E48A045DAAA420332752EAB69
SHA-256:	7E821E0AEC9F19EEE04B3C9026BC4D58738D17493798CD5035C7774012DA6368
SHA-512:	3194B39D53AB12780D2456F0FF343EE13EA13899CC24D91377059F9FD26E7052B02A50B6691EB254D7DB4B24DAC6BD1C468DB7311F001436C63A351240B6990D
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/04f32d9e-1729-4d42-82b5-91c2350ff323/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (both from Booking.com and other trusted pa

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (647)
Category:	downloaded
Size (bytes):	514678
Entropy (8bit):	5.669850658889447
Encrypted:	false
SSDEEP:	6144:58+cCxHn6/Wk+Zx1raepBj8oQHOlkjc7n/NrfQjFw/hrPutvvQmkUtV6:5/bZk/ShQumirfqFw/MKmkUK
MD5:	37C6AF40DD48A63FCC1BE84EAAF44F05
SHA1:	1D708ACE806D9E78A21F2A5F89424372E249F718
SHA-256:	DAF20B4DBC2EE9CC700E99C7BE570105ECAF649D9C044ADB62A2098CF4662D24
SHA-512:	A159BF35FC7F6EFDBE911B2F24019DCA5907DB8CF9BA516BF18E3A228009055BCD9B26A3486823D56EACC391A3E0CC4AE917607BD95A3AD2F02676430DE03E07
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. o

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6427
Entropy (8bit):	4.861223156043332
Encrypted:	false
SSDEEP:	96:FQef+XH7M70djbWejwZ1ICFBr81YO7+VlyZ2PK/ppdkvbMFIKuFsVzgoAytvPBxr:FsrMYoZdD0dcg/HavbKm89
MD5:	D6865979621492BAC92096993C559C43
SHA1:	6FE79DBD9D775D24ACA921E5B6ED9EEC4572F31E
SHA-256:	3D5DB88A81FF70F7D26E336FC8ED4188F5AE5032F97D334E4288322889096B77
SHA-512:	2C6D42383FA0C6C441BB810B0E25322ABAE62903B3E2DC2AAB563F4DA6419DB196FABE1D1229583F682180C3A144E5709E2C3EE529EF53211010B11A05D9B3D5
Malicious:	false
Reputation:	low
URL:	https://accommodations.booking.com/orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE
Preview:	{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExperimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":0,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":0},"copyTags":{"webcore_shell_footer_booking_statement":"{b_companyname} is part of Booking Holdings Inc., the world leader in online travel and related services.\n","webcore_shell_footer_copyright_statement":"Copyright . 1996.{currentYear} Booking.com.. All rights reserved.","a11y_webshell_close_currency_selector":"Close currency selector","a11y_webshell_close_language_selector":"Close language selector","a11y_webshell_header_tools_currency":"Prices in {selected_currency}","a11y_webshell_header_tools_language":"Language: {selected_lang}","traveller_header_account_currency_all":"All currencies","traveller_header_account_currency_most_often":"Suggested for

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.841014016708303
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt0gEi16bP5vsLqo4p:VKEcPw/VKonR3evtTA8O01iGLrwUnG
MD5:	3259D942739B9C07E25675A3049492FC
SHA1:	95041E8A70CF23B17C1F411EEDC9663BC901BD57
SHA-256:	A40DD5CFB0DD11AAB95CF3D51B8681AA1A0D3DCC22D1FBCEA28F26C02FB50A35
SHA-512:	5B8F27594AE3E0603F5E85791824B4B3F5CC92D4DB59E332FC22FE522716936C3BB8DA04B59860EE6AC7A91C3A93A178B907D21E3842EDB16E654325C733AF61
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360602797
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/reca

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 600x600, components 3
Category:	downloaded
Size (bytes):	58468
Entropy (8bit):	7.965316284905664
Encrypted:	false
SSDEEP:	1536:9LDIp+d3biZIdqabQacr0M5SlzYhMCR4tL5PlXENRqlbN8:VDIYdmAqaPy0F97ZJEnSbi
MD5:	F26D87CFFF3BF9A03D784279DBF8EDDA
SHA1:	C9DEB14F7CC4589FBC2B08890F0C1D92F6E9DCB5
SHA-256:	4027C476CFD72CCABB6168C85804436D0B1A2ADFFC4928163DACDAEE1A9010F7
SHA-512:	D8DCDA0D21F394E0CA88B3118D4D37578E9E2A6D91B44E653A50A346EB55E84985F35B98D93797C41A1904A24112A09DD1DEC9E9BD1C2E1B123CB5EDD92D4686
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/600x600/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:(..!...I@.E.)1@.HE:...h..%..QE.%....RR.i......(...J)i(.(... 4....R.Z(.(4QLBPii(.(.......P.h........J(....ZJ.`.....E.P.QKE.%.Q@.E-.....P.QKI@...(.(...))h....(...(.......1E..JZ(..R.@.P.I,.....aV.>..W;.N.-..U..&..b1....+...f..J(.....P.E.P.b...@.....J(....ZJ.J)i)..R.P ........@.E-%0.JZ(..QE..(....QKE......JLR.@.I.u%.%.....R.P.IKE.%.Q@....S.(...J)h........ZJ.J)h....(.(.....(..

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1591
Entropy (8bit):	6.299213971363517
Encrypted:	false
SSDEEP:	24:DRINGdp3+42X9tK0Td/YpgLWnTmSPq/rZZhwjeqcJJG0ZtNy6LBiyy3XX6w:DCc3YNtK0R/YrnTmSPE1Z6sJjy+B8n6w
MD5:	B6D0B31340D7A113F63B936E23D06F78
SHA1:	268E3856DA737F7E56E679258949EF70DDDE47F4
SHA-256:	18C62988860A8FFD90BAB6376B4FE36A723BD39403C420D3943AA3EB5A0029C5
SHA-512:	FEF2D5BA4648EE1BA476E3FBD4852E52F93A0F40988F368AF90DF4188F64E6DCB09BDE79887A4AB3FE81774168D84E6DFCB61AFBA44DC6FB56C3C72D808E23DC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png
Preview:	.PNG........IHDR...[............b....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................If.....tRNS...........gx.]:..HR.0..#(..$/.+!....'-.....;...h\|ZW...u....iK..o....`e.....pP"...t.....V.....rO..... N..b..c.sm..3..[.4~.9.I.....M..n{.^a...UL.?...6T.l..<...@...B\.7...S........bKGD...-.....IDATH....WLQ....t!.\..b..S.4M2. 5..2#N.]NE........&B.T"..\.?.L.I..j...e.k....u..k...dA.......(p.. ZB..k.u.....e..BB7.bo.

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17042), with no line terminators
Category:	downloaded
Size (bytes):	17042
Entropy (8bit):	5.531136625767756
Encrypted:	false
SSDEEP:	384:kEwsyBuJhxxE/zb3wwNzrsCpxtn8iqy0buhCYsNH:rwwJhXmvA4z5tDqy0buBe
MD5:	17FD211C2A919C7CAF8DF394B4B052E0
SHA1:	B3CA2562D778E462638FD3CF891A47C01860FC75
SHA-256:	D02AA6C3AE2F5437578C6644A1237636315CEACF8000379A2757F7CA85D49760
SHA-512:	E9AEBB85B5E3282D7C7D1E0699304BE5BA2216A41DE0DA3306DB25FBE234A11D47EC6C18481DA76DFFA4E0AC237402C148AA755CD64006095A9ED0855B4DE534
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/0Cqmw64vVDdXjGZEoSN2NjFc6s-AADeaJ1f3yoXUl2A.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var c=this\|\|self,L=function(f){return f},P=function(f,F){if(!(F=(f=null,c.trustedTypes),F)\|\|!F.createPolicy)return f;try{f=F.createPolicy("bg",{createHTML:L,createScript:L,createScriptURL:L})}catch(r){c.console&&c.console.error(r.message)}return f};(0,eval)(function(f,F){return(F=P())&&1===f.eval(F.createScript("1"))?function(r){return F.createScript(r)}:function(r){return""+r}}(c)(Array(7824Math.random()\|0).join("\n")+'(function(){var FF=function(F,f,c,L,Y){function a(){}return Y=(L=(F=fp(F,function(r){a&&(f&&X(f),c=r,a(),a=void 0)},!!(c=void 0,f)),F)[1],F[0]),{invoke:function(r,P,p,m){function M(){c(function(B){X(function(){r(B)})},p)}if(!P)return P=Y(p),r&&r(P),P;c?M():(m=a,a=function(){X((m(),M))})},pe:function(r){L&&L(r)}}},Y7=function(F,f,c,L,Y){if((Y=F[0],Y)==v)f.P_=25,f.K(F);else if(Y==d){L=F[1];try{c=f.v\|\|f.K(F)}catch(a){R(a,f),c=f.v}L(c)}else if(Y==rJ)f.K(F);else if(Y==V)f.K

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (52155), with no line terminators
Category:	downloaded
Size (bytes):	52156
Entropy (8bit):	5.358566566679159
Encrypted:	false
SSDEEP:	1536:5GK5/2jEwG9BckF74OZk9zpbrzga2sPns:L5NwG9BckX+pfzV2sPns
MD5:	CCF26FB1244D25C75D392D7C23D61600
SHA1:	57C0E12FB0B1F039E151E1FDACABE931BFA3C38E
SHA-256:	2B5EFF8AB6AAD9F36198A6911AFA4EB1C1EDBD630AB8434962C5813313D02BD9
SHA-512:	D297C7B20262D3AB94688C5DFB8A52FC8D9A7347C63C8E4143CB2E413827763CEBF0DDE027105962D342D7FD05224CCF81F780EC2E753E36ADCF16F7EB35B23F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.calendar2={loaded:!0,run:!1}),booking.ensureNamespaceExists("calendar2"),function(n,r,s,t,e){_i_("a41:4ad9b9b1"),s.ONE_DAY=864e5,s.SUNDAY_FIRST=!0,s.DAYS_IN_MONTH=[31,28,31,30,31,30,31,31,30,31,30,31],s.DAY_STATES={disabled:!0,weekend:!0,selected:!0,hilighted:!0,"in-range":!0,"first-in-range":!0,"last-in-range":!0,today:!0};var i=1;s.uid=function(){return _i_("a41:c7bf35e2"),_r_("calendar_"+ ++i)},s.today=function(){_i_("a41:f68deab7");var t=new Date(1e3*n.env.b_timestamp),e=new Date,i=Math.abs(t-e)>s.ONE_DAY;return _r_(i?new Date(t.getUTCFullYear(),t.getUTCMonth(),t.getUTCDate(),0,0,0,0):new Date(e.getFullYear(),e.getMonth(),e.getDate(),0,0,0,0))},s.minToday=function(){_i_("a41:544125b3");var t=new Date(Date.now()-396e5);return _r_(new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth(),t.getUTCDate(),0,0,0,0)))},s.dayId=function(t,e,i){return _i_("a41:edc

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.403590365002627
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tJ8/V+/B6dS8p:6v/lhPfA/UJ63p
MD5:	EDB2AA47631C67A43709D4CCD2501E33
SHA1:	87475B448C53CF32FFE78AB121DB8BAB41D478E0
SHA-256:	6019C3C9E47DC991F8D9937DEAFBB0740C2E61E321324798CB508773B0814824
SHA-512:	65820EEAF261F01988570AFE7866D9B83901950DFBD89542009A1FAAAE520E1AF2FA08789B7E94A64B0E1A3BDC39256354EFE1D38856621851DD65E80505DBB2
Malicious:	false
Reputation:	low
URL:	https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-2J9RiUwC227b84Dh6MIXwLUNPlIp0WTbXhNT8A
Preview:	.PNG........IHDR.....................IDATx.c........o.......IEND.B`.

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (46612)
Category:	downloaded
Size (bytes):	46823
Entropy (8bit):	5.225996051387525
Encrypted:	false
SSDEEP:	768:ocUza37Daagd4PdYyZgUP9IzmSmeZQIVNlBzUbVsCHS9hs30G:oclgjyDlIzmBeZtVcbS9u
MD5:	86931E68978A1846CFAA0CDCBA9E07AB
SHA1:	5420163DB22CF9AB44012865CFE831BD50979CFD
SHA-256:	4C28E3B1FAA2D9A9599C89169C1E469E3F7B4C3C9E4BA51D0EE552718054FCD6
SHA-512:	16FC589AA0F46E9C914357DA5140A167E1CEC6CD265658F22D8B4B129A516DD4A7AB18F63FDA5A55FC6700BEB38EBF6C98524B47FE1DEF99113E054F8849005A
Malicious:	false
Reputation:	low
URL:	https://dynamic.criteo.com/js/ld/ld.js?a=37158
Preview:	window.Criteo=window.Criteo\|\|{};window.Criteo.oneTagConfig={partnerId:37158,visitEventEnabled:true,fpIdentifier:undefined,waitForGum:true,dynamic:!0,gumDomain:"gum.criteo.com",privateModeDetectionEnabled:true};.!function(){"use strict";function s(e,t){var n,o,i=null===(n=window.Criteo)\|\|void 0===n?void 0:n.oneTagConfig;return null!==(o=i&&i[e])&&void 0!==o?o:t}var c,e,u="5.20.0";(e=c=c\|\|{})[e.None=0]="None",e[e.Cookie=1]="Cookie",e[e.LocalStorage=2]="LocalStorage";var M=(o.checkLocalStorageIsWritable=function(){try{if(!window.localStorage)return!1;var e="criteo_localstorage_check";return window.localStorage.setItem(e,e),window.localStorage.removeItem(e),!0}catch(e){return!1}},o.checkCookiesAreWritable=function(){var e=new o("criteo_write_test",1e4);e.setValueWithNoDomain("1");var t="1"===e.cookieValue;return e.removeWithNoDomain(),t},o.prototype.setCookieRead=function(){this.isCookieRead=!0},o.prototype.setValue=function(e,t){void 0===t&&(t=!0),this.cookieValue=e,this.isCookieValueExte

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	downloaded
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202308.1.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	868846
Entropy (8bit):	4.580425930962864
Encrypted:	false
SSDEEP:	3072:DCneVHECLcQNzl0wx2KtIP/J1JmgugQOMA+QvtmqNtYDdeAmebjc7wFAIbtaxecm:WMx2KtIP/J1JmgusH8d2PkcQJrUwhb1B
MD5:	208E83AAB1A66B2DF03E2388EA2F9E19
SHA1:	C246897A9BCF459E35526D3E41FB0CCD680FD866
SHA-256:	F26074295B2F62E4ECDCC16B2044199B5C17E84C9397703F5816DB4CAD71CDC1
SHA-512:	03F6B8BE14B4BF4CD096173EB18566397734F698172229CB82EA24AB2E1880ABBBDE24A281A130500ACE454503CD473304477204AC5EA17763BECE4D53664E92
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4e596c2c.b4b42785.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4e596c2c","64ca3669","b8cc452d","5eacf50d","c58d9455"],{"51a388c3":function(a,e,t){var n=t("6e8b4072");e.Z=n.Z},"44f0a6f8":function(a,e,t){var n=t("ead71eb0");e.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"m 24 12 C 24 5.37 18.63 0 12 0 S 0 5.37 0 12 c 0 3.81 1.78 7.2 4.55 9.4 c 0 0 0 0.01 0.01 0.01 c 0.02 0.02 0.04 0.02 0.06 0.04 C 6.724 23.104 9.324 24.002 12 24 c 2.79 0 5.35 -0.96 7.39 -2.55 c 0.022 -0.01 0.042 -0.023 0.06 -0.04 c 0 0 0 -0.01 0.01 -0.01 C 22.22 19.2 24 15.81 24 12 z M 2 12 C 2 6.48 6.48 2 12 2 s 10 4.48 10 10 c 0.004 2.901 -1.26 5.659 -3.46 7.55 c -0.76 -0.61 -1.61 -1.12 -2.51 -1.49 C 14.75 17.53 13.38 17.25 12 17.25 c -1.38 0 -2.75 0.27 -4.03 0.81 c -0.91 0.38 -1.75 0.88 -2.51 1.49 C 3.26 17.659 1.996 14.901 2 12 z m 10 2.25 c -2.49 0 -4.5 -2.01 -4.5 -4.5

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	1420626
Entropy (8bit):	5.462970234070235
Encrypted:	false
SSDEEP:	6144:1p3Jc9GB/rqFrH5ur6YyUup+19l/EhiwUYzPnW24y/K+Q+Fwvg4jcWjAXOK2aYm6:1xJc0Bm5H4r6jslgUMnW2NY5j+XO+/Hi
MD5:	3C3AF787849F9FEBA7396D9EDF6877E4
SHA1:	511474CF182AFE382407EFEEA3C25557B3D968BB
SHA-256:	5AD790E42F0B56464084A444CFEC3E371E272D0274032A1532B728E28EC00252
SHA-512:	EB7024C4220E8A4E7F77B3646A7E5626641B0C956EB79F50ED4EAB97E38E58AF30143A80B6698AD053DB52664399252F76F3579001E65156FABBD26583F03FF9
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4dfc553b.0654ebd5.chunk.js
Preview:	/! For license information please see 4dfc553b.0654ebd5.chunk.js.LICENSE.txt /.(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4dfc553b"],{"34d5c10f":function(e,t,o){"use strict";var n=o("ead71eb0");t.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M10.5 14.781v6.968a2.25 2.25 0 0 0 2.25 2.25h6a2.25 2.25 0 0 0 2.25-2.25v-6.968a.75.75 0 0 0-1.5 0v6.968a.75.75 0 0 1-.75.75h-6a.75.75 0 0 1-.75-.75v-6.968a.75.75 0 0 0-1.5 0zm13.252 2.142l-6.5-5.847a2.25 2.25 0 0 0-3.01 0l-6.5 5.847a.75.75 0 0 0 1.004 1.116l6.5-5.847a.75.75 0 0 1 1.002 0l6.5 5.847a.75.75 0 0 0 1.004-1.116zM8.25 22.5h-6l.75.75V1.5l-.001.002L13.48 5.765c.02.008.019.007.019.006V8.25a.75.75 0 0 0 1.5 0V5.77c0-.626-.39-1.185-.975-1.403L3.545.105A1.499 1.499 0 0 0 1.5 1.5l.001 21.751c0 .414.336.75.75.75h6a.75.75 0 0 0 0-1.5zm-6 0H.75a.75.75 0 0 0 0 1.5h1.5a.75.75 0 0 0 0-1.5zM

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	dropped
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6610
Entropy (8bit):	4.800246623550685
Encrypted:	false
SSDEEP:	192:FnF7pSdDHj3uRCwpY6vepSdDH34w8psdXH78WaJcB:vdwDHj3uswpzowDH34/2XH78WaJcB
MD5:	E36A9DECC7446396FC5979FBB772B1E8
SHA1:	0897A5B166218946D4C2FC59C61DF0064DB540CE
SHA-256:	4F17CA2398E3D9A723DB002D6410192EF52AB2DA7205B845E96F2A255566C165
SHA-512:	C4681065926E9ED54569A230F006CDB2913C8C2DABFCA68A8D8523E8E54E1FA88EEC93AE255F699750744BBA04AA375E610B6C309BF6C1027C4A596A0998BFE6
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea94870-d4b1-483a-b1d2-faf1d982bb31","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5571
Entropy (8bit):	7.911129446769755
Encrypted:	false
SSDEEP:	96:ghIE2tGm4eGwtSB/zkLS0XcggJr+HvXr/hhGtcYZskvU:mIVtQeGw4lzWSQc3evXr/hwton
MD5:	F496F8B627C128FFADC8772E29C8D712
SHA1:	92D9EAFCE5AFFEF1158743BF1AC768703096CDC9
SHA-256:	9CD751C772BE140862566B72806AB9157C1AEAB1F02942EC4B2627995446DA6F
SHA-512:	6E33458F7ECDC24AE944CB7D7F9CB84F511A229E0103B6FBEFF3F629FB5874E28E9A26578137E56F2ACDA98C2D45A840CB50902CC6396C2AEB413F9E9E9BECED
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M4.M5...M4.M4.Fj6.MF..Dj&.MD..F..T.Q51..0..i..4.O4.T&0..<..1.4.Nc.....Ns........=(..M4P..dT..{o.....@.h....?.L..m7I.s.$.OR....R.S....E2d.....d...\w<:...EI.".....9.?_.Y;.<..j.w....{..?..U.3........f........}..?J.4.(S.....G.[.3..}.P.........=/S.At......o...+..Aw.h....hgD...;.y..(.../...7r8L..i.9Oi4.\.ZG.&/3.b.s..z.....#64.mC..L...$pJ.<..p?.C.b"j..V...DMQ1.Z

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65386)
Category:	downloaded
Size (bytes):	447655
Entropy (8bit):	5.5010006604353725
Encrypted:	false
SSDEEP:	6144:W6BT9xN0dGG8wFGDOhqVBOiau0BSlcFZ9liywhaDjYtsJxu60Iuggvhdn:W6BTxnVD07liXsJkIFc
MD5:	92E447DFA69920621B30C2DC29BDFB52
SHA1:	64FC0EF1DFFCF907231D32BB2DFFE42AF7242447
SHA-256:	C211E8775861EB70A495EDC9B39D509002676809A57ED8090817E78F764B57FE
SHA-512:	AEF4A7AD68E8FD34EF368B428B6F47EFF43DEE25810A5828C2369D31075293C29CB88A159CAA5B557A3C41AEC72004535558A09F7F67F8C09AD2038B304BCBEF
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401080101/pubads_impl.js?cb=31080328
Preview:	(function(_){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ ./ . . SPDX-License-Identifier: Apache-2.0 .*/ .var ba,fa,ia,ka,na,qa,sa,wa,va,xa,za,Ba,Ca,Da,Fa,Ga,La,Na,Oa,Qa,Sa,$a,gb,ib,kb,mb,qb,ub,zb,Ab,Ib,Kb,Mb,Ob,Pb,Ub,Wb,Vb,Zb,$b,Qb,ac,cc,gc,hc,jc,mc,nc,oc,pc,qc,rc,tc,uc,xc,yc,zc,Ec,Fc,Hc,Jc,Gc,Lc,Nc,Oc,Qc,Rc,Sc,Tc,Uc,Vc,Xc,bd,gd,hd,id,$c,jd,Zc,Yc,kd,ld,md,nd,od,pd,qd,td,sd,vd,wd,yd,Cd,Dd,Fd,Gd,Hd,Jd,Id,Pd,Rd,Qd,Td,Sd,Ud,Wd,Ed,ae,be,ee,le,fe,he,ke,me,ne,qe,se,ue,ve,ye,ze,Ae,ge,Be,Ce,Ee,Fe,Ge,Ke,Le,Me,Ie,Se,Je,Te,Ye,$e,bf,hf,jf,kf,of,pf,qf,wf,xf,zf,Af,Bf,Cf,Df,Gf,Kf,Mf,Lf,Qf,Sf,Tf,Wf,Xf,Yf,dg,fg,hg,jg,kg,ng,og,pg,qg,sg,tg,vg,wg,yg,Ag,Bg,Cg,Dg,Gg,Ig,Mg,Kg,Qg,Sg,Tg,Og,Pg,Ug,Vg,Wg,Zg,ch,dh,Eh,Gh,Hh,Kh,Oh,Rh,Th,Vh,Wh,Xh,Yh,Zh,$h,bi,ei,hi,ji,ki,ni,li,qi,ri,si,wi,xi,Di,Ei,Pi,Vi,Ti,Ui,mj,qj,sj,tj,uj,wj,Aj,Jj,Dj,xj,Rj,Pj,Qj,Tj,Uj,ak,hk,kk,lk,mk,L,nk,tk,rk,Ek,Hk,O,Jk,Kk,Lk,Nk,Pk,Qk,Xk,Yk,$k,al,gl,nl,pl,rl,sl,tl,vl,yl,Cl,El,Gl,Fl,Nl,Ol,Pl,Ql,Hl,Sl,Il,Vl

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23311), with no line terminators
Category:	downloaded
Size (bytes):	23311
Entropy (8bit):	5.413169897014635
Encrypted:	false
SSDEEP:	384:jLdisPaC+iSweA7/XinkmNof3kjJHpyvg65EEOcmqjdPyLO/x+0MBpQGdAXGpnES:v8sPaCdSweA7/XinkmNofUNHpyA3cmq4
MD5:	F3399BC3A541E5A78E376D6E92E92775
SHA1:	194808083CA3EDE83CE1962A0742DE141F334C29
SHA-256:	C325C5335B214125E72DD8E2B3AB939C15F4C47764399AC61BBC1EBC24FC9F87
SHA-512:	609A8E5A00F99E1F271BD60ADB78CE09A6DF46452DA79896F0E08EDE8C597146E3C4F96C21767906A34DEB2117748E17E29CF825D5B13A353992AE3B2D13830D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/index_cloudfront_sd/331a3004219803fef71cbd62c4678669e7e692e4.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};_i_("e4e:5aad9878"),B.when({events:"ready",condition:B.env.b_personalized_layout_id}).run(function(e){_i_("e4e:712489dd"),setTimeout(function(){_i_("e4e:dca24cc5"),function(e){_i_("e4e:d650e1fd");var t=e("utils/throttled"),i=e("utils/inviewport"),n=e("et"),r=$("[data-qmab-component-id]").toArray().map(function(e){return _i_("e4e:c14f039d"),_r_({el:$(e),id:Number(e.getAttribute("data-qmab-component-id"))})}),_=[].map(function(e){return _i_("e4e:2f942a3a"),_r_({el:$(e.selector),id:e.id})}).concat(r);_.forEach(function(e){_i_("e4e:9c651222"),e.el.click(function(){_i_("e4e:d486362c"),s(B.env.b_personalized_layout_id,"click",e.id,B.env.b_index_personalized_layout_exp_name,B.env.b_index_personalized_layout_exp_variant),n.customGoal("cCGaYSddOEGcHNAEQfKCePBeZTPSeUFRURURHe",1),_r_()}),_r_()});var a=t(function(){_i_("e4e:fef16651");var t=[];_.forEach(function(e){_i_("e4e:ccaf30e9"),i(e.el)?s(B.env.b_personalized_layout_id,"view"

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39979)
Category:	downloaded
Size (bytes):	40091
Entropy (8bit):	5.429260762915304
Encrypted:	false
SSDEEP:	384:Yq50b8RBAvhrhaNd1k5xk5gwbaDxathflTPMFM0AKZuojnJvUuwo9XsrZZTimS4q:YqmjrhaD1k5xkLaF5uP++nylss8gRf
MD5:	77D9652109EDCBE3F31B58B71033F4FA
SHA1:	86E5DCDB4E55D99B70B506E72CF04722DBA4DC47
SHA-256:	23896943E88A08E681AB2C90914A8397B8FAA91039DF8CFD7A45E82B785BABE5
SHA-512:	5FF132F93310DB2A30F6F4FF184087041B43B5F43F9F131C2269A3C4BE06ED0E1808F876C1BFBE74855E771E3B5E0C27B3F4A7D4B28328AB0EF3BD98BAC4634B
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/0a098284.3c62999d.chunk.js
Preview:	(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0a098284"],{"181eacc8":function(e,n,t){"use strict";t.d(n,{d:function(){return i}});var r=t("6ee88c54"),s=t("dc6d28ff"),o=t("d1e54a96");const i=()=>{let e;const n=(0,s.getRequestContext)().getSiteType(),t=(0,o.isRTL)();switch(n){case r.N.ANDROID:case r.N.IOS:case r.N.MDOT:e="small";break;case r.N.TDOT:e="medium";break;default:e="large"}return{defaultViewportSize:e,defaultRTL:t}}},"64b778ad":function(e,n,t){"use strict";t.r(n);var r=t("3d054e81"),s=t("ead71eb0"),o=t.n(s),i=t("cedcabf9"),c=t.n(i),a=t("181eacc8"),u=t("dee2534d"),l=t.n(u),d=t("90a20ace"),h=t.n(d),v=t("6ee88c54"),p=t("dc6d28ff"),m=t.n(p),f=t("28dbd132"),y=t.n(f),S=t("41c6c66e"),A=t.n(S),E=t("d16e9636"),b=t.n(E),N=t("975f4b85"),R=t("aef1fcb8"),_=t("3439c104"),g=t("81556d54"),T=t("98f608d3");const{staticRoutes:k,...I}=T,C=(0,E.loadable)({resolved:{},chunkName(){return"bWebcorePersonalisationComponentService-

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2542), with no line terminators
Category:	downloaded
Size (bytes):	2542
Entropy (8bit):	5.973727423701742
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081Q3LeSVH/KMtuFhtzYiglV:wsbSUtJfxrqLWWWdV6j1OL9HyMct9yv
MD5:	018F1DCB9649A08ED880A2A91422867F
SHA1:	3025EEC7BB365D4240AF38788D87A60872F10E36
SHA-256:	5F5F00C7318E5E8A9C8CE848643F37C63D518C0A4D7963550955AB023DDA175F
SHA-512:	B75FDDDCB707AEC6F339A3CAECAB8784B376D207AAE0F7D76026D999590C7ACC3986C55B2FECC91C421054442BEA489FA14295667E7EFC92B837BF4F72FE152B
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1705360607982&cv=11&fst=1705360607982&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://0bc83a5be386a6200edf12c709bbfe62.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6613
Entropy (8bit):	4.8008586386275605
Encrypted:	false
SSDEEP:	192:FLF7pSdDHj34w8psdXH7uRCwpY6vepSdDH3oqjJcn:PdwDHj34/2XH7uswpzowDH3oqjJcn
MD5:	9BC67327163540F8BA264789217F9C55
SHA1:	F82EBA39A5169F873C6B4796BFA05CFEC5987974
SHA-256:	C6C4CAB9BF775042437310A3642624659B69FA5DA77FC743C4F7F224BBE7AEC7
SHA-512:	4DEAE57B3CE26CC3DE2C29BE5E580F199EE1BB5672634187EA6103326C2AA25426B4453DC1C21191B7648BC18D00D5DF7354DBC3385386A5A5704AD21844743A
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/04f32d9e-1729-4d42-82b5-91c2350ff323/04f32d9e-1729-4d42-82b5-91c2350ff323.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"04f32d9e-1729-4d42-82b5-91c2350ff323","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1597)
Category:	downloaded
Size (bytes):	1713
Entropy (8bit):	5.174608444183338
Encrypted:	false
SSDEEP:	24:5ECLvGWV/lweFZ3UYVN/QZSKGkMF6l4Q5fJ9VArxijT0nuvLSSqoZ:5/LvGatweFNUY//Qegl9FJ9IijTXaoZ
MD5:	51BE0C43CC481B13FE70D3BA27E2FFD9
SHA1:	F25639014CDA8BF794AF82D1CD784871CC70A7DE
SHA-256:	CB8E8F2FA50E2C77C3717D0F81B9E7CD9483D9CF99BE47C93E6FB31295E52261
SHA-512:	074F5D81271E67A5841C40A362FCE33C0169D81B8BB8628FD12FA1A6616014B58272DA7D0F878524AEC4A0420CF9F878499EA34647F00908A1F7DB0EB06AE371
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css
Preview:	.c1f4ef4d83{margin-top:var(--bui_spacing_1x);margin-bottom:var(--bui_spacing_2x)}.a8d1f39845{margin-bottom:var(--bui_spacing_4x)}.f742a100f0{margin-bottom:var(--bui_spacing_3x)}.d5376772eb{margin-bottom:var(--bui_spacing_2x)}.a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin-top:var(--bui_spacing_2x);margin-bottom:0!important}.c3a4d3369f div{margin-bottom:var(--bui_spacing_half)}.fbbd4482e9{position:absolute;top:var(--bui_spacing_3x);left:var(--bui_spacing_3x);margin-right:var(--bui_spacing_3x)}.dd8e2ae84f{color:var(--bui_color_black)}.d1c3bff2b4{width:100%;height:100%}.ae2824c1f5{border:1px solid var(--bui_color_action_foreground);color:var(--bui_color_action_foreground);text-align:center}.dcc1c777cd{width:-moz-min-content;width:min-content}.a9e2165731{display:-webkit-box;-webkit-lin

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 714 x 471, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	62401
Entropy (8bit):	7.9871887601831935
Encrypted:	false
SSDEEP:	1536:C4uYaTtopxISOKH2tdIdWqH9h2jXHMBfqXijncyCx4yzj+:CnzT2ISOK4dhqdh2LHCi4f2zzj+
MD5:	D8C78BB4AA47AB6AE3DF9D9E2FD9501E
SHA1:	8C959E1DA33C4EEE451EF13E2CD0F8B2327B7F76
SHA-256:	34643FF9CA4B3EA1209F72B31DFCF85C0D23A9D389766BD908EFF7A8DFD51F8A
SHA-512:	1FB28A2A22AFAAF382A0FF74339FD641A09E2C58B6BAB5B88C6EE7C447F1909502B952C3B86D7F9007F52400EDC205A187D23E74485885E246926E96B162D1E7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............6\|... .IDATx^..w..gy....<.O;S.Q.d..W$[...6......d.&. ....;}.Ih.%._.8........6.E.%..>..9.......<g4g..._/aI.z....s=.."""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""R\|.@DDDd.j..<i0...d.hs..%^.z...._......L..,""""2..e.....!((......AAYDDDDd..."""""CPP.................EDDDD...,""""2..e.....!...D..~..W..r.h...K5...y..EDDD&......>!.C.A~....P..`m..[..;0.`-X.@.k..O..-X.p8........}...Z{..\|....bPP.sb...FjIR..,.xWX......cs...O...`...g...Ms.o...0.....s.....nw...9..r.p.`9.f1)DDDD.@AYF.>RQG..v\.#.y.......;(......R.]j.}......s.c..}....71f.n..nJ4.3..%.......eD.5.4QK0p.x..I\g=fc.N.....wX....`....4^..<.e.....7a.M<C.....s....0...LMv#..\N...........3..ST.C......r;^...n3...Sf+....c:m.....((. ...x..f=.A`.4.8)....`;....I.}.y....w.....L....H.vB...C..*6.[6?.?6..P...b/.x..O..c.1....n.!..4"""23L.0$.f...S.o..?a.<...f.p-...r.9...l.O..g}.Yc........MAy..................,..2.]....I.\|...;n..".........IAy..OQK..ek./

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4643), with no line terminators
Category:	downloaded
Size (bytes):	4643
Entropy (8bit):	5.408274426198107
Encrypted:	false
SSDEEP:	96:9WsFpRR6JYMuuwCp0y/hALDdh42MGkm8NcxYMel1pecbt:9+d2CpSjDMiRxYM6wcbt
MD5:	13732720BDB48CC3C14028344351272B
SHA1:	4DE3DD0C23E46B5AC55151DB4871AF4CD0F59B63
SHA-256:	C6BBA8AD5AD5EC6A4FEF018600B107F518172053FDF5CB10200CAC55EE23F2D1
SHA-512:	C3F96D3FA9C037B503D9BFB70FEFD9D7789C3302A391F1A81A46AFAD9FB3040FAF52F8142D9503AAE7D54E1731D01B262A516B3CBFEF831BF8785E9985A811DA
Malicious:	false
Reputation:	low
URL:	https://s.pinimg.com/ct/core.js
Preview:	!function(t){var i={};function r(n){var e;return(i[n]\|\|(e=i[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,r),e.l=!0,e)).exports}r.m=t,r.c=i,r.d=function(n,e,t){r.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},r.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"u",{value:!0})},r.t=function(e,n){if(1&n&&(e=r(e)),8&n)return e;if(4&n&&"object"==typeof e&&e&&e.u)return e;var t=Object.create(null);if(r.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var i in e)r.d(t,i,function(n){return e[n]}.bind(null,i));return t},r.n=function(n){var e=n&&n.u?function(){return n.default}:function(){return n};return r.d(e,"a",e),e},r.o=function(n,e){return Object.prototype.hasOwnProperty.call(n,e)},r.p="",r(r.s=2)}([function(n,e){function t(n,e){return function(n){if(Array.isArray(n))return n}(n)\|\|function(n,e){var t=null==n?null:"undefined"!=typ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2024 00:16:03.385812998 CET	192.168.2.5	1.1.1.1	0x822d	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:03.386173010 CET	192.168.2.5	1.1.1.1	0x55e9	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:03.387968063 CET	192.168.2.5	1.1.1.1	0x9fdc	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:03.388475895 CET	192.168.2.5	1.1.1.1	0x379d	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:05.782799959 CET	192.168.2.5	1.1.1.1	0xb614	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.796367884 CET	192.168.2.5	1.1.1.1	0x6e60	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:05.958379030 CET	192.168.2.5	1.1.1.1	0xd263	Standard query (0)	booking.com-find-book.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.958544970 CET	192.168.2.5	1.1.1.1	0xa0b6	Standard query (0)	booking.com-find-book.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:06.484481096 CET	192.168.2.5	1.1.1.1	0xa3b9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.484925032 CET	192.168.2.5	1.1.1.1	0xd974	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:07.253261089 CET	192.168.2.5	1.1.1.1	0x491d	Standard query (0)	booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:07.253509045 CET	192.168.2.5	1.1.1.1	0x6546	Standard query (0)	booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:08.171874046 CET	192.168.2.5	1.1.1.1	0xcc56	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.172288895 CET	192.168.2.5	1.1.1.1	0xa3b4	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:09.055032015 CET	192.168.2.5	1.1.1.1	0x1034	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.058868885 CET	192.168.2.5	1.1.1.1	0x581a	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:09.066562891 CET	192.168.2.5	1.1.1.1	0x8fe5	Standard query (0)	shelves.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.066844940 CET	192.168.2.5	1.1.1.1	0xe242	Standard query (0)	shelves.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:09.920207977 CET	192.168.2.5	1.1.1.1	0x22b2	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.920936108 CET	192.168.2.5	1.1.1.1	0xff10	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:10.883346081 CET	192.168.2.5	1.1.1.1	0xa83d	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.884078979 CET	192.168.2.5	1.1.1.1	0x2b47	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:15.725786924 CET	192.168.2.5	1.1.1.1	0x1828	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.726566076 CET	192.168.2.5	1.1.1.1	0xce97	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:15.728519917 CET	192.168.2.5	1.1.1.1	0xd905	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.730643988 CET	192.168.2.5	1.1.1.1	0xdb75	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Jan 16, 2024 00:16:15.732168913 CET	192.168.2.5	1.1.1.1	0xc56f	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.732949018 CET	192.168.2.5	1.1.1.1	0xa10d	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:15.737529039 CET	192.168.2.5	1.1.1.1	0xe0f2	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.738554955 CET	192.168.2.5	1.1.1.1	0xbcc3	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.661557913 CET	192.168.2.5	1.1.1.1	0x95a2	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.662105083 CET	192.168.2.5	1.1.1.1	0xbe8a	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.783574104 CET	192.168.2.5	1.1.1.1	0x1c77	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.783885956 CET	192.168.2.5	1.1.1.1	0x8e08	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.784815073 CET	192.168.2.5	1.1.1.1	0x551a	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.785104036 CET	192.168.2.5	1.1.1.1	0x85a3	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.817951918 CET	192.168.2.5	1.1.1.1	0x68ec	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.818216085 CET	192.168.2.5	1.1.1.1	0x353	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.819044113 CET	192.168.2.5	1.1.1.1	0x4baf	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.819307089 CET	192.168.2.5	1.1.1.1	0x2f01	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.824038982 CET	192.168.2.5	1.1.1.1	0x621c	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.824362993 CET	192.168.2.5	1.1.1.1	0x3f14	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:16.961993933 CET	192.168.2.5	1.1.1.1	0x440c	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.961994886 CET	192.168.2.5	1.1.1.1	0xe833	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:17.199331999 CET	192.168.2.5	1.1.1.1	0x1050	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.199774981 CET	192.168.2.5	1.1.1.1	0x661e	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:17.201303959 CET	192.168.2.5	1.1.1.1	0x7fba	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.201778889 CET	192.168.2.5	1.1.1.1	0xc849	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Jan 16, 2024 00:16:17.556581974 CET	192.168.2.5	1.1.1.1	0x7c34	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.557070017 CET	192.168.2.5	1.1.1.1	0x6334	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:17.857620001 CET	192.168.2.5	1.1.1.1	0xadda	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.858374119 CET	192.168.2.5	1.1.1.1	0x3391	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:18.019738913 CET	192.168.2.5	1.1.1.1	0x1b80	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.019932985 CET	192.168.2.5	1.1.1.1	0x8a23	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:18.099046946 CET	192.168.2.5	1.1.1.1	0xd0a6	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.099294901 CET	192.168.2.5	1.1.1.1	0x2f71	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:18.745330095 CET	192.168.2.5	1.1.1.1	0xf8c9	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.745330095 CET	192.168.2.5	1.1.1.1	0xdeb	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:18.783591032 CET	192.168.2.5	1.1.1.1	0x8b1f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.783793926 CET	192.168.2.5	1.1.1.1	0x609e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:19.230403900 CET	192.168.2.5	1.1.1.1	0xeba4	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.230798006 CET	192.168.2.5	1.1.1.1	0xe71c	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:19.349450111 CET	192.168.2.5	1.1.1.1	0xb692	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.349841118 CET	192.168.2.5	1.1.1.1	0xe76	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:20.071733952 CET	192.168.2.5	1.1.1.1	0x5a95	Standard query (0)	accommodations.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:20.073148012 CET	192.168.2.5	1.1.1.1	0x3209	Standard query (0)	accommodations.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:22.260267019 CET	192.168.2.5	1.1.1.1	0xb26b	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.260852098 CET	192.168.2.5	1.1.1.1	0x8b3f	Standard query (0)	google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:22.267168999 CET	192.168.2.5	1.1.1.1	0xad6d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.268282890 CET	192.168.2.5	1.1.1.1	0x9926	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:22.754209042 CET	192.168.2.5	1.1.1.1	0x7f65	Standard query (0)	www3.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:22.754209042 CET	192.168.2.5	1.1.1.1	0xd3f5	Standard query (0)	www3.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.345700979 CET	192.168.2.5	1.1.1.1	0x72e1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.346174002 CET	192.168.2.5	1.1.1.1	0xc5d1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:23.422930956 CET	192.168.2.5	1.1.1.1	0x1ba9	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.423326015 CET	192.168.2.5	1.1.1.1	0x5189	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.369411945 CET	192.168.2.5	1.1.1.1	0x7e76	Standard query (0)	sc-static.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.405983925 CET	192.168.2.5	1.1.1.1	0xacb	Standard query (0)	sc-static.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.408452988 CET	192.168.2.5	1.1.1.1	0x1518	Standard query (0)	s.pinimg.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.408802032 CET	192.168.2.5	1.1.1.1	0xc5a2	Standard query (0)	s.pinimg.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.411443949 CET	192.168.2.5	1.1.1.1	0x53b6	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.411645889 CET	192.168.2.5	1.1.1.1	0xb8a6	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.412717104 CET	192.168.2.5	1.1.1.1	0xad49	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.412878036 CET	192.168.2.5	1.1.1.1	0x6876	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.837465048 CET	192.168.2.5	1.1.1.1	0x3d34	Standard query (0)	marketingplatform.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.837835073 CET	192.168.2.5	1.1.1.1	0xcce4	Standard query (0)	marketingplatform.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:24.911747932 CET	192.168.2.5	1.1.1.1	0x441e	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.912010908 CET	192.168.2.5	1.1.1.1	0x6e3a	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:25.640974998 CET	192.168.2.5	1.1.1.1	0x771e	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.640974998 CET	192.168.2.5	1.1.1.1	0x9452	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:25.668236971 CET	192.168.2.5	1.1.1.1	0x21a2	Standard query (0)	accommodations.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.669209003 CET	192.168.2.5	1.1.1.1	0x4ff0	Standard query (0)	accommodations.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:25.948577881 CET	192.168.2.5	1.1.1.1	0x18e	Standard query (0)	gtm-mktg.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.949178934 CET	192.168.2.5	1.1.1.1	0xd179	Standard query (0)	gtm-mktg.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:26.204833031 CET	192.168.2.5	1.1.1.1	0xcc04	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.205383062 CET	192.168.2.5	1.1.1.1	0x23cb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.383896112 CET	192.168.2.5	1.1.1.1	0xffb2	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.384345055 CET	192.168.2.5	1.1.1.1	0x38d1	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.403508902 CET	192.168.2.5	1.1.1.1	0xb70d	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.403920889 CET	192.168.2.5	1.1.1.1	0xbc5d	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.407638073 CET	192.168.2.5	1.1.1.1	0xf0d6	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.407639027 CET	192.168.2.5	1.1.1.1	0x6568	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.422637939 CET	192.168.2.5	1.1.1.1	0x3e70	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.422637939 CET	192.168.2.5	1.1.1.1	0xc9bc	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.599450111 CET	192.168.2.5	1.1.1.1	0x4a1c	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.599797964 CET	192.168.2.5	1.1.1.1	0x4f17	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.704051018 CET	192.168.2.5	1.1.1.1	0x4bde	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.705249071 CET	192.168.2.5	1.1.1.1	0x9141	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.774455070 CET	192.168.2.5	1.1.1.1	0x42d7	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.774816036 CET	192.168.2.5	1.1.1.1	0x562c	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:27.780720949 CET	192.168.2.5	1.1.1.1	0x6374	Standard query (0)	marketingplatform.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.781027079 CET	192.168.2.5	1.1.1.1	0xff49	Standard query (0)	marketingplatform.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:28.315321922 CET	192.168.2.5	1.1.1.1	0xe2aa	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.315576077 CET	192.168.2.5	1.1.1.1	0xb2a8	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:28.589962959 CET	192.168.2.5	1.1.1.1	0xe53b	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.590698004 CET	192.168.2.5	1.1.1.1	0x451c	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:28.761586905 CET	192.168.2.5	1.1.1.1	0x5b29	Standard query (0)	tr6.snapchat.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.762044907 CET	192.168.2.5	1.1.1.1	0xa058	Standard query (0)	tr6.snapchat.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:28.918576956 CET	192.168.2.5	1.1.1.1	0xf79d	Standard query (0)	sc-static.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.919158936 CET	192.168.2.5	1.1.1.1	0x10a5	Standard query (0)	sc-static.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:30.470254898 CET	192.168.2.5	1.1.1.1	0x4a7d	Standard query (0)	pixel.tapad.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:30.470944881 CET	192.168.2.5	1.1.1.1	0x206e	Standard query (0)	pixel.tapad.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.026912928 CET	192.168.2.5	1.1.1.1	0x86be	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.027283907 CET	192.168.2.5	1.1.1.1	0xe2cf	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.028842926 CET	192.168.2.5	1.1.1.1	0xe85b	Standard query (0)	gtm-mktg.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.029293060 CET	192.168.2.5	1.1.1.1	0x7ecd	Standard query (0)	gtm-mktg.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.509457111 CET	192.168.2.5	1.1.1.1	0x6352	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.512820959 CET	192.168.2.5	1.1.1.1	0xf5ac	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.555569887 CET	192.168.2.5	1.1.1.1	0xdca7	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.556206942 CET	192.168.2.5	1.1.1.1	0x9a7d	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.571721077 CET	192.168.2.5	1.1.1.1	0x6c4f	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.572177887 CET	192.168.2.5	1.1.1.1	0x9b4f	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:31.589539051 CET	192.168.2.5	1.1.1.1	0xc39d	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.590183973 CET	192.168.2.5	1.1.1.1	0x1385	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:32.832496881 CET	192.168.2.5	1.1.1.1	0x76bb	Standard query (0)	web-perf.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.832861900 CET	192.168.2.5	1.1.1.1	0x8d1	Standard query (0)	web-perf.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:37.351612091 CET	192.168.2.5	1.1.1.1	0x19fd	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.352101088 CET	192.168.2.5	1.1.1.1	0xe00	Standard query (0)	google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:37.353264093 CET	192.168.2.5	1.1.1.1	0x5691	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.353441954 CET	192.168.2.5	1.1.1.1	0x371d	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:37.957532883 CET	192.168.2.5	1.1.1.1	0x4c29	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:37.957532883 CET	192.168.2.5	1.1.1.1	0xab4f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.929383039 CET	192.168.2.5	1.1.1.1	0x23de	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.929754019 CET	192.168.2.5	1.1.1.1	0x5300	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:16:47.082309008 CET	192.168.2.5	1.1.1.1	0x8bf3	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.082509995 CET	192.168.2.5	1.1.1.1	0x3e3b	Standard query (0)	google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:47.083039045 CET	192.168.2.5	1.1.1.1	0x30be	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.083504915 CET	192.168.2.5	1.1.1.1	0xe60f	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:47.661046982 CET	192.168.2.5	1.1.1.1	0x336b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.661315918 CET	192.168.2.5	1.1.1.1	0xf440	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:48.739576101 CET	192.168.2.5	1.1.1.1	0x8af7	Standard query (0)	www.googletagservices.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:48.739576101 CET	192.168.2.5	1.1.1.1	0x3bfa	Standard query (0)	www.googletagservices.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:48.740293026 CET	192.168.2.5	1.1.1.1	0x6373	Standard query (0)	z.moatads.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:48.740664005 CET	192.168.2.5	1.1.1.1	0xf083	Standard query (0)	z.moatads.com	65	IN (0x0001)	false
Jan 16, 2024 00:16:49.728094101 CET	192.168.2.5	1.1.1.1	0xa742	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:49.728476048 CET	192.168.2.5	1.1.1.1	0x6708	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:01.354362965 CET	192.168.2.5	1.1.1.1	0x1c5e	Standard query (0)	secure.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:01.354810953 CET	192.168.2.5	1.1.1.1	0xe8ba	Standard query (0)	secure.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:06.792314053 CET	192.168.2.5	1.1.1.1	0xaaf4	Standard query (0)	secure.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.792648077 CET	192.168.2.5	1.1.1.1	0xc3fd	Standard query (0)	secure.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:08.364168882 CET	192.168.2.5	1.1.1.1	0xb648	Standard query (0)	join.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:08.364847898 CET	192.168.2.5	1.1.1.1	0x49a6	Standard query (0)	join.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:09.615081072 CET	192.168.2.5	1.1.1.1	0x46a	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.615997076 CET	192.168.2.5	1.1.1.1	0x8ea8	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:11.429788113 CET	192.168.2.5	1.1.1.1	0xfa3	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:11.430346012 CET	192.168.2.5	1.1.1.1	0xdb2a	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:13.012347937 CET	192.168.2.5	1.1.1.1	0x34ab	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.013194084 CET	192.168.2.5	1.1.1.1	0x3e7	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:13.080554962 CET	192.168.2.5	1.1.1.1	0xafc7	Standard query (0)	q.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.081429958 CET	192.168.2.5	1.1.1.1	0x9721	Standard query (0)	q.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:13.083122969 CET	192.168.2.5	1.1.1.1	0x3b7e	Standard query (0)	booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.083803892 CET	192.168.2.5	1.1.1.1	0x123	Standard query (0)	booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:14.197056055 CET	192.168.2.5	1.1.1.1	0xc288	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.197777987 CET	192.168.2.5	1.1.1.1	0xa02d	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:14.278660059 CET	192.168.2.5	1.1.1.1	0x3d51	Standard query (0)	join.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.279366016 CET	192.168.2.5	1.1.1.1	0x487c	Standard query (0)	join.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:14.288189888 CET	192.168.2.5	1.1.1.1	0x646	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.288722038 CET	192.168.2.5	1.1.1.1	0x6852	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:14.289563894 CET	192.168.2.5	1.1.1.1	0x6881	Standard query (0)	q.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.289869070 CET	192.168.2.5	1.1.1.1	0x52f2	Standard query (0)	q.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:14.290988922 CET	192.168.2.5	1.1.1.1	0xf740	Standard query (0)	booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.291874886 CET	192.168.2.5	1.1.1.1	0x7576	Standard query (0)	booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:15.059616089 CET	192.168.2.5	1.1.1.1	0xe501	Standard query (0)	11963210.fls.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.060034037 CET	192.168.2.5	1.1.1.1	0x9ec6	Standard query (0)	11963210.fls.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:15.103287935 CET	192.168.2.5	1.1.1.1	0xdeb0	Standard query (0)	dynamic.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.103956938 CET	192.168.2.5	1.1.1.1	0x7478	Standard query (0)	dynamic.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:15.699991941 CET	192.168.2.5	1.1.1.1	0xeabb	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.700678110 CET	192.168.2.5	1.1.1.1	0x31eb	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:15.965008974 CET	192.168.2.5	1.1.1.1	0x30d8	Standard query (0)	gum.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.965322018 CET	192.168.2.5	1.1.1.1	0xb27e	Standard query (0)	gum.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:16.841447115 CET	192.168.2.5	1.1.1.1	0x74a	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.842175007 CET	192.168.2.5	1.1.1.1	0x510b	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:16.887754917 CET	192.168.2.5	1.1.1.1	0x9ddc	Standard query (0)	gum.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.888154984 CET	192.168.2.5	1.1.1.1	0xd89c	Standard query (0)	gum.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:16.896536112 CET	192.168.2.5	1.1.1.1	0x9e24	Standard query (0)	sslwidget.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.896919012 CET	192.168.2.5	1.1.1.1	0xe991	Standard query (0)	sslwidget.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.423501015 CET	192.168.2.5	1.1.1.1	0xa713	Standard query (0)	measurement-api.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.423924923 CET	192.168.2.5	1.1.1.1	0xba54	Standard query (0)	measurement-api.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.456965923 CET	192.168.2.5	1.1.1.1	0x20e	Standard query (0)	fledge.us.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.457467079 CET	192.168.2.5	1.1.1.1	0xb540	Standard query (0)	fledge.us.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.474982977 CET	192.168.2.5	1.1.1.1	0xffc	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.475255013 CET	192.168.2.5	1.1.1.1	0x4faf	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.475833893 CET	192.168.2.5	1.1.1.1	0xc9ce	Standard query (0)	x.bidswitch.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.476217031 CET	192.168.2.5	1.1.1.1	0xd52c	Standard query (0)	x.bidswitch.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.476609945 CET	192.168.2.5	1.1.1.1	0x3177	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.476788044 CET	192.168.2.5	1.1.1.1	0xa329	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.477237940 CET	192.168.2.5	1.1.1.1	0x2690	Standard query (0)	partner.mediawallahscript.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.477580070 CET	192.168.2.5	1.1.1.1	0x880f	Standard query (0)	partner.mediawallahscript.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.477958918 CET	192.168.2.5	1.1.1.1	0x2b1d	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.478190899 CET	192.168.2.5	1.1.1.1	0x2665	Standard query (0)	contextual.media.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.478661060 CET	192.168.2.5	1.1.1.1	0x8984	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.478940964 CET	192.168.2.5	1.1.1.1	0xa82c	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.479384899 CET	192.168.2.5	1.1.1.1	0x299e	Standard query (0)	rtb-csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.479717016 CET	192.168.2.5	1.1.1.1	0xbdcf	Standard query (0)	rtb-csync.smartadserver.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.480175018 CET	192.168.2.5	1.1.1.1	0x8536	Standard query (0)	sync-t1.taboola.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.480395079 CET	192.168.2.5	1.1.1.1	0xd488	Standard query (0)	sync-t1.taboola.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.480739117 CET	192.168.2.5	1.1.1.1	0xae02	Standard query (0)	criteo-sync.teads.tv	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.481072903 CET	192.168.2.5	1.1.1.1	0xda78	Standard query (0)	criteo-sync.teads.tv	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.481880903 CET	192.168.2.5	1.1.1.1	0x43ff	Standard query (0)	eb2.3lift.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.482120991 CET	192.168.2.5	1.1.1.1	0xbed6	Standard query (0)	eb2.3lift.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.920944929 CET	192.168.2.5	1.1.1.1	0xc9b4	Standard query (0)	measurement-api.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.921174049 CET	192.168.2.5	1.1.1.1	0x9e83	Standard query (0)	measurement-api.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:17.934731960 CET	192.168.2.5	1.1.1.1	0xf46f	Standard query (0)	measurement-api.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.935077906 CET	192.168.2.5	1.1.1.1	0x3215	Standard query (0)	measurement-api.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.088413000 CET	192.168.2.5	1.1.1.1	0x8b9b	Standard query (0)	ups.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.088413000 CET	192.168.2.5	1.1.1.1	0x2bd9	Standard query (0)	ups.analytics.yahoo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.093049049 CET	192.168.2.5	1.1.1.1	0x8942	Standard query (0)	hb.yahoo.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.093302965 CET	192.168.2.5	1.1.1.1	0x2138	Standard query (0)	hb.yahoo.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.093795061 CET	192.168.2.5	1.1.1.1	0x914e	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.093933105 CET	192.168.2.5	1.1.1.1	0x51c4	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.109935045 CET	192.168.2.5	1.1.1.1	0xf8e1	Standard query (0)	visitor.omnitagjs.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.112651110 CET	192.168.2.5	1.1.1.1	0x9711	Standard query (0)	visitor.omnitagjs.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.128345013 CET	192.168.2.5	1.1.1.1	0x4a6a	Standard query (0)	pixel.rubiconproject.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.128345013 CET	192.168.2.5	1.1.1.1	0x94cf	Standard query (0)	pixel.rubiconproject.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.129048109 CET	192.168.2.5	1.1.1.1	0x46d7	Standard query (0)	sync-t1.taboola.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.133105040 CET	192.168.2.5	1.1.1.1	0xb892	Standard query (0)	sync-t1.taboola.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.133436918 CET	192.168.2.5	1.1.1.1	0xe395	Standard query (0)	rtb-csync.smartadserver.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.133702993 CET	192.168.2.5	1.1.1.1	0xac63	Standard query (0)	rtb-csync.smartadserver.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.222429991 CET	192.168.2.5	1.1.1.1	0xad7d	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.222708941 CET	192.168.2.5	1.1.1.1	0x7405	Standard query (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.241976023 CET	192.168.2.5	1.1.1.1	0xa90b	Standard query (0)	gum.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.241976023 CET	192.168.2.5	1.1.1.1	0x9659	Standard query (0)	gum.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.242837906 CET	192.168.2.5	1.1.1.1	0x9d57	Standard query (0)	r.casalemedia.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.243098021 CET	192.168.2.5	1.1.1.1	0x6630	Standard query (0)	r.casalemedia.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.589471102 CET	192.168.2.5	1.1.1.1	0x5c44	Standard query (0)	secure.adnxs.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.589865923 CET	192.168.2.5	1.1.1.1	0xcb47	Standard query (0)	secure.adnxs.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.683603048 CET	192.168.2.5	1.1.1.1	0xfee6	Standard query (0)	ads.stickyadstv.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.684005976 CET	192.168.2.5	1.1.1.1	0xce81	Standard query (0)	ads.stickyadstv.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.699027061 CET	192.168.2.5	1.1.1.1	0x555a	Standard query (0)	ad.360yield.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.699278116 CET	192.168.2.5	1.1.1.1	0xe81d	Standard query (0)	ad.360yield.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.700126886 CET	192.168.2.5	1.1.1.1	0xb2e8	Standard query (0)	i.liadm.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.700393915 CET	192.168.2.5	1.1.1.1	0x39fa	Standard query (0)	i.liadm.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.741785049 CET	192.168.2.5	1.1.1.1	0x40be	Standard query (0)	tags.bluekai.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.742137909 CET	192.168.2.5	1.1.1.1	0x4fef	Standard query (0)	tags.bluekai.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.784625053 CET	192.168.2.5	1.1.1.1	0x8547	Standard query (0)	exchange.mediavine.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.784950018 CET	192.168.2.5	1.1.1.1	0x995f	Standard query (0)	exchange.mediavine.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.824668884 CET	192.168.2.5	1.1.1.1	0x4bd1	Standard query (0)	criteo-sync.teads.tv	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.825196028 CET	192.168.2.5	1.1.1.1	0xf565	Standard query (0)	criteo-sync.teads.tv	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.828651905 CET	192.168.2.5	1.1.1.1	0x94f2	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.829166889 CET	192.168.2.5	1.1.1.1	0x9b2d	Standard query (0)	contextual.media.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.902494907 CET	192.168.2.5	1.1.1.1	0x4076	Standard query (0)	x.bidswitch.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.902951002 CET	192.168.2.5	1.1.1.1	0x8f4b	Standard query (0)	x.bidswitch.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.919998884 CET	192.168.2.5	1.1.1.1	0x839d	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.921005964 CET	192.168.2.5	1.1.1.1	0x1162	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:18.923851013 CET	192.168.2.5	1.1.1.1	0x539d	Standard query (0)	visitor.omnitagjs.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.924185991 CET	192.168.2.5	1.1.1.1	0x699f	Standard query (0)	visitor.omnitagjs.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.078737974 CET	192.168.2.5	1.1.1.1	0x554f	Standard query (0)	eb2.3lift.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.079958916 CET	192.168.2.5	1.1.1.1	0x99c2	Standard query (0)	eb2.3lift.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.203784943 CET	192.168.2.5	1.1.1.1	0x7ec7	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.204351902 CET	192.168.2.5	1.1.1.1	0x5076	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.700834036 CET	192.168.2.5	1.1.1.1	0x57e3	Standard query (0)	sync.outbrain.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.701406956 CET	192.168.2.5	1.1.1.1	0x4812	Standard query (0)	sync.outbrain.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.702574015 CET	192.168.2.5	1.1.1.1	0x9de4	Standard query (0)	simage2.pubmatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.704385042 CET	192.168.2.5	1.1.1.1	0x230e	Standard query (0)	simage2.pubmatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.706367016 CET	192.168.2.5	1.1.1.1	0xe462	Standard query (0)	sync.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.707035065 CET	192.168.2.5	1.1.1.1	0x8c71	Standard query (0)	sync.crwdcntrl.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.708472013 CET	192.168.2.5	1.1.1.1	0x740f	Standard query (0)	trends.revcontent.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.709049940 CET	192.168.2.5	1.1.1.1	0xa73e	Standard query (0)	trends.revcontent.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.722389936 CET	192.168.2.5	1.1.1.1	0xd719	Standard query (0)	match.sharethrough.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.723325014 CET	192.168.2.5	1.1.1.1	0x6037	Standard query (0)	match.sharethrough.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:19.783680916 CET	192.168.2.5	1.1.1.1	0xb0f2	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.784492016 CET	192.168.2.5	1.1.1.1	0xd984	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.066298008 CET	192.168.2.5	1.1.1.1	0xdfd1	Standard query (0)	s.ad.smaato.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.067246914 CET	192.168.2.5	1.1.1.1	0x30b7	Standard query (0)	s.ad.smaato.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.225281000 CET	192.168.2.5	1.1.1.1	0x62a3	Standard query (0)	tags.bluekai.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.226404905 CET	192.168.2.5	1.1.1.1	0x9bd	Standard query (0)	tags.bluekai.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.231280088 CET	192.168.2.5	1.1.1.1	0xc7b3	Standard query (0)	ads.stickyadstv.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.232036114 CET	192.168.2.5	1.1.1.1	0xd703	Standard query (0)	ads.stickyadstv.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.237276077 CET	192.168.2.5	1.1.1.1	0x4ee	Standard query (0)	r.casalemedia.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.238240957 CET	192.168.2.5	1.1.1.1	0x354	Standard query (0)	r.casalemedia.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.242573977 CET	192.168.2.5	1.1.1.1	0x57a9	Standard query (0)	exchange.mediavine.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.243748903 CET	192.168.2.5	1.1.1.1	0x40cb	Standard query (0)	exchange.mediavine.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.539048910 CET	192.168.2.5	1.1.1.1	0x529f	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.539048910 CET	192.168.2.5	1.1.1.1	0xc9b7	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.540280104 CET	192.168.2.5	1.1.1.1	0x5c41	Standard query (0)	ad.360yield.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.540879965 CET	192.168.2.5	1.1.1.1	0xce6a	Standard query (0)	ad.360yield.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.552927017 CET	192.168.2.5	1.1.1.1	0x279e	Standard query (0)	trends.revcontent.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.554608107 CET	192.168.2.5	1.1.1.1	0xe90a	Standard query (0)	trends.revcontent.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.554608107 CET	192.168.2.5	1.1.1.1	0xa82a	Standard query (0)	simage2.pubmatic.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.555114985 CET	192.168.2.5	1.1.1.1	0x5bf7	Standard query (0)	simage2.pubmatic.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.556938887 CET	192.168.2.5	1.1.1.1	0x7c	Standard query (0)	match.sharethrough.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.557486057 CET	192.168.2.5	1.1.1.1	0x66e8	Standard query (0)	match.sharethrough.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:20.559089899 CET	192.168.2.5	1.1.1.1	0x26a0	Standard query (0)	sync.outbrain.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.559488058 CET	192.168.2.5	1.1.1.1	0x2c0	Standard query (0)	sync.outbrain.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.001739025 CET	192.168.2.5	1.1.1.1	0xa40b	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.002155066 CET	192.168.2.5	1.1.1.1	0x7fc0	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.015127897 CET	192.168.2.5	1.1.1.1	0xd0ec	Standard query (0)	1f2e7.v.fwmrm.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.016038895 CET	192.168.2.5	1.1.1.1	0x75ec	Standard query (0)	1f2e7.v.fwmrm.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.034423113 CET	192.168.2.5	1.1.1.1	0x8b3c	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.034715891 CET	192.168.2.5	1.1.1.1	0xdee9	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.292104006 CET	192.168.2.5	1.1.1.1	0xa62e	Standard query (0)	hb.yahoo.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.292824030 CET	192.168.2.5	1.1.1.1	0x8b0d	Standard query (0)	hb.yahoo.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.439873934 CET	192.168.2.5	1.1.1.1	0x9178	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.440800905 CET	192.168.2.5	1.1.1.1	0xec0b	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.444461107 CET	192.168.2.5	1.1.1.1	0xe130	Standard query (0)	i6.liadm.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.444905996 CET	192.168.2.5	1.1.1.1	0xb066	Standard query (0)	i6.liadm.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.930192947 CET	192.168.2.5	1.1.1.1	0x4000	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.931133032 CET	192.168.2.5	1.1.1.1	0x3f09	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.946403027 CET	192.168.2.5	1.1.1.1	0x8be1	Standard query (0)	match.prod.bidr.io	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.947093010 CET	192.168.2.5	1.1.1.1	0x3a3	Standard query (0)	match.prod.bidr.io	65	IN (0x0001)	false
Jan 16, 2024 00:17:21.959673882 CET	192.168.2.5	1.1.1.1	0x28c0	Standard query (0)	i6.liadm.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.960541964 CET	192.168.2.5	1.1.1.1	0x826b	Standard query (0)	i6.liadm.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:22.670033932 CET	192.168.2.5	1.1.1.1	0x2d96	Standard query (0)	static.criteo.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.675059080 CET	192.168.2.5	1.1.1.1	0xb526	Standard query (0)	static.criteo.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:22.701158047 CET	192.168.2.5	1.1.1.1	0x1a7e	Standard query (0)	aa.agkn.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.701713085 CET	192.168.2.5	1.1.1.1	0x7db1	Standard query (0)	aa.agkn.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:23.118871927 CET	192.168.2.5	1.1.1.1	0x3740	Standard query (0)	ws.rqtrk.eu	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.119363070 CET	192.168.2.5	1.1.1.1	0xd93b	Standard query (0)	ws.rqtrk.eu	65	IN (0x0001)	false
Jan 16, 2024 00:17:23.419970989 CET	192.168.2.5	1.1.1.1	0x97c8	Standard query (0)	static.criteo.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.433495998 CET	192.168.2.5	1.1.1.1	0x27da	Standard query (0)	aa.agkn.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.434039116 CET	192.168.2.5	1.1.1.1	0x73b5	Standard query (0)	aa.agkn.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:24.197949886 CET	192.168.2.5	1.1.1.1	0x2aa7	Standard query (0)	aa.agkn.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.233443022 CET	192.168.2.5	1.1.1.1	0x222b	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.234544992 CET	192.168.2.5	1.1.1.1	0x4f21	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Jan 16, 2024 00:17:25.284842968 CET	192.168.2.5	1.1.1.1	0xd978	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:25.285341024 CET	192.168.2.5	1.1.1.1	0x774b	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:26.066725969 CET	192.168.2.5	1.1.1.1	0x8693	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.070708990 CET	192.168.2.5	1.1.1.1	0x1bc5	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:26.286361933 CET	192.168.2.5	1.1.1.1	0x13f2	Standard query (0)	pr-bh.ybp.yahoo.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.286688089 CET	192.168.2.5	1.1.1.1	0x9e47	Standard query (0)	pr-bh.ybp.yahoo.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:28.096916914 CET	192.168.2.5	1.1.1.1	0xa448	Standard query (0)	pm.w55c.net	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.096916914 CET	192.168.2.5	1.1.1.1	0x7d60	Standard query (0)	pm.w55c.net	65	IN (0x0001)	false
Jan 16, 2024 00:17:29.558645964 CET	192.168.2.5	1.1.1.1	0x571c	Standard query (0)	sync.ipredictive.com	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.558726072 CET	192.168.2.5	1.1.1.1	0x74e4	Standard query (0)	sync.ipredictive.com	65	IN (0x0001)	false
Jan 16, 2024 00:17:30.579715967 CET	192.168.2.5	1.1.1.1	0x5c1f	Standard query (0)	jelly.mdhv.io	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:30.579715967 CET	192.168.2.5	1.1.1.1	0xd793	Standard query (0)	jelly.mdhv.io	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2024 00:16:03.489459038 CET	1.1.1.1	192.168.2.5	0x9fdc	No error (0)	accounts.google.com		142.251.16.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.879429102 CET	1.1.1.1	192.168.2.5	0xb614	No error (0)	clients.l.google.com		142.251.163.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:05.894809008 CET	1.1.1.1	192.168.2.5	0x6e60	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:06.061186075 CET	1.1.1.1	192.168.2.5	0xa0b6	No error (0)	booking.com-find-book.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:06.119160891 CET	1.1.1.1	192.168.2.5	0xd263	No error (0)	booking.com-find-book.com		104.21.35.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.119160891 CET	1.1.1.1	192.168.2.5	0xd263	No error (0)	booking.com-find-book.com		172.67.176.184	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581420898 CET	1.1.1.1	192.168.2.5	0xd974	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:06.581522942 CET	1.1.1.1	192.168.2.5	0xa3b9	No error (0)	www.google.com		172.253.122.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:07.350979090 CET	1.1.1.1	192.168.2.5	0x491d	No error (0)	booking.com		13.249.39.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:07.350979090 CET	1.1.1.1	192.168.2.5	0x491d	No error (0)	booking.com		13.249.39.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:07.350979090 CET	1.1.1.1	192.168.2.5	0x491d	No error (0)	booking.com		13.249.39.92	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:07.350979090 CET	1.1.1.1	192.168.2.5	0x491d	No error (0)	booking.com		13.249.39.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.268292904 CET	1.1.1.1	192.168.2.5	0xcc56	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:08.268292904 CET	1.1.1.1	192.168.2.5	0xcc56	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.92	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.268292904 CET	1.1.1.1	192.168.2.5	0xcc56	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.268292904 CET	1.1.1.1	192.168.2.5	0xcc56	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.268292904 CET	1.1.1.1	192.168.2.5	0xcc56	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:08.269846916 CET	1.1.1.1	192.168.2.5	0xa3b4	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.168612957 CET	1.1.1.1	192.168.2.5	0x581a	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.173748970 CET	1.1.1.1	192.168.2.5	0x1034	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.173748970 CET	1.1.1.1	192.168.2.5	0x1034	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.173748970 CET	1.1.1.1	192.168.2.5	0x1034	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.173748970 CET	1.1.1.1	192.168.2.5	0x1034	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.173748970 CET	1.1.1.1	192.168.2.5	0x1034	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.178404093 CET	1.1.1.1	192.168.2.5	0xe242	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.178404093 CET	1.1.1.1	192.168.2.5	0xe242	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.80	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.15	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:09.179729939 CET	1.1.1.1	192.168.2.5	0x8fe5	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.016642094 CET	1.1.1.1	192.168.2.5	0x22b2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.054050922 CET	1.1.1.1	192.168.2.5	0xff10	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.054050922 CET	1.1.1.1	192.168.2.5	0xff10	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.054050922 CET	1.1.1.1	192.168.2.5	0xff10	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.982554913 CET	1.1.1.1	192.168.2.5	0xa83d	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:10.983809948 CET	1.1.1.1	192.168.2.5	0x2b47	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.983809948 CET	1.1.1.1	192.168.2.5	0x2b47	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:10.983809948 CET	1.1.1.1	192.168.2.5	0x2b47	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.825922012 CET	1.1.1.1	192.168.2.5	0x1828	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.825922012 CET	1.1.1.1	192.168.2.5	0x1828	No error (0)	securepubads46.g.doubleclick.net		172.253.115.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.825922012 CET	1.1.1.1	192.168.2.5	0x1828	No error (0)	securepubads46.g.doubleclick.net		172.253.115.156	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.826668978 CET	1.1.1.1	192.168.2.5	0xce97	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.828428984 CET	1.1.1.1	192.168.2.5	0xd905	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.828428984 CET	1.1.1.1	192.168.2.5	0xd905	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.830296040 CET	1.1.1.1	192.168.2.5	0xdb75	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Jan 16, 2024 00:16:15.834053993 CET	1.1.1.1	192.168.2.5	0xc56f	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.834053993 CET	1.1.1.1	192.168.2.5	0xc56f	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.834053993 CET	1.1.1.1	192.168.2.5	0xc56f	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.834053993 CET	1.1.1.1	192.168.2.5	0xc56f	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.834053993 CET	1.1.1.1	192.168.2.5	0xc56f	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.835360050 CET	1.1.1.1	192.168.2.5	0xa10d	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.840022087 CET	1.1.1.1	192.168.2.5	0xe0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:15.841303110 CET	1.1.1.1	192.168.2.5	0xbcc3	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.841303110 CET	1.1.1.1	192.168.2.5	0xbcc3	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:15.841303110 CET	1.1.1.1	192.168.2.5	0xbcc3	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.758666039 CET	1.1.1.1	192.168.2.5	0x95a2	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.758666039 CET	1.1.1.1	192.168.2.5	0x95a2	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.58	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.758666039 CET	1.1.1.1	192.168.2.5	0x95a2	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.75	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.758666039 CET	1.1.1.1	192.168.2.5	0x95a2	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.98	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.758666039 CET	1.1.1.1	192.168.2.5	0x95a2	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.52	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.759476900 CET	1.1.1.1	192.168.2.5	0xbe8a	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.886656046 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.45	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.886656046 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.119	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.886656046 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.886656046 CET	1.1.1.1	192.168.2.5	0x551a	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.20	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.893028975 CET	1.1.1.1	192.168.2.5	0x8e08	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.897351980 CET	1.1.1.1	192.168.2.5	0x1c77	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.897351980 CET	1.1.1.1	192.168.2.5	0x1c77	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.897351980 CET	1.1.1.1	192.168.2.5	0x1c77	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.897351980 CET	1.1.1.1	192.168.2.5	0x1c77	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.897351980 CET	1.1.1.1	192.168.2.5	0x1c77	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.914915085 CET	1.1.1.1	192.168.2.5	0x4baf	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920186996 CET	1.1.1.1	192.168.2.5	0x621c	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920186996 CET	1.1.1.1	192.168.2.5	0x621c	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920186996 CET	1.1.1.1	192.168.2.5	0x621c	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920186996 CET	1.1.1.1	192.168.2.5	0x621c	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920186996 CET	1.1.1.1	192.168.2.5	0x621c	No error (0)	d1of1hbywxxm65.cloudfront.net		13.249.39.92	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920260906 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920260906 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920260906 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920260906 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920260906 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:16.920399904 CET	1.1.1.1	192.168.2.5	0x3f14	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.922133923 CET	1.1.1.1	192.168.2.5	0x353	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.923171997 CET	1.1.1.1	192.168.2.5	0x2f01	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.923171997 CET	1.1.1.1	192.168.2.5	0x2f01	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:16.923171997 CET	1.1.1.1	192.168.2.5	0x2f01	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:17.057451963 CET	1.1.1.1	192.168.2.5	0x440c	No error (0)	accounts.google.com		172.253.115.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.300755024 CET	1.1.1.1	192.168.2.5	0x661e	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:17.301017046 CET	1.1.1.1	192.168.2.5	0x1050	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.301017046 CET	1.1.1.1	192.168.2.5	0x1050	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.301604033 CET	1.1.1.1	192.168.2.5	0x7fba	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.301604033 CET	1.1.1.1	192.168.2.5	0x7fba	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.302495956 CET	1.1.1.1	192.168.2.5	0xc849	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Jan 16, 2024 00:16:17.654426098 CET	1.1.1.1	192.168.2.5	0x7c34	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.115	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.654426098 CET	1.1.1.1	192.168.2.5	0x7c34	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.30	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.654426098 CET	1.1.1.1	192.168.2.5	0x7c34	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.123	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.654426098 CET	1.1.1.1	192.168.2.5	0x7c34	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.26	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.953955889 CET	1.1.1.1	192.168.2.5	0xadda	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.953955889 CET	1.1.1.1	192.168.2.5	0xadda	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:17.954866886 CET	1.1.1.1	192.168.2.5	0x3391	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:18.116961956 CET	1.1.1.1	192.168.2.5	0x1b80	No error (0)	stats.g.doubleclick.net		142.251.111.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.116961956 CET	1.1.1.1	192.168.2.5	0x1b80	No error (0)	stats.g.doubleclick.net		142.251.111.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.195740938 CET	1.1.1.1	192.168.2.5	0xd0a6	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:18.195740938 CET	1.1.1.1	192.168.2.5	0xd0a6	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.75	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.195740938 CET	1.1.1.1	192.168.2.5	0xd0a6	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.98	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.195740938 CET	1.1.1.1	192.168.2.5	0xd0a6	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.58	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.195740938 CET	1.1.1.1	192.168.2.5	0xd0a6	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.52	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.197139025 CET	1.1.1.1	192.168.2.5	0x2f71	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:18.842367887 CET	1.1.1.1	192.168.2.5	0xf8c9	No error (0)	stats.g.doubleclick.net		142.251.111.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.842367887 CET	1.1.1.1	192.168.2.5	0xf8c9	No error (0)	stats.g.doubleclick.net		142.251.111.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.880516052 CET	1.1.1.1	192.168.2.5	0x8b1f	No error (0)	www.google.com		172.253.115.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:18.881001949 CET	1.1.1.1	192.168.2.5	0x609e	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:18.979617119 CET	1.1.1.1	192.168.2.5	0x789a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:18.979617119 CET	1.1.1.1	192.168.2.5	0x789a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.329381943 CET	1.1.1.1	192.168.2.5	0xeba4	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.30	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.329381943 CET	1.1.1.1	192.168.2.5	0xeba4	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.123	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.329381943 CET	1.1.1.1	192.168.2.5	0xeba4	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.115	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.329381943 CET	1.1.1.1	192.168.2.5	0xeba4	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		52.85.132.26	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.450664997 CET	1.1.1.1	192.168.2.5	0xe76	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:19.451108932 CET	1.1.1.1	192.168.2.5	0xb692	No error (0)	www.google.com		142.251.167.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:20.171904087 CET	1.1.1.1	192.168.2.5	0x3209	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:20.199933052 CET	1.1.1.1	192.168.2.5	0x5a95	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:20.199933052 CET	1.1.1.1	192.168.2.5	0x5a95	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.78	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:20.199933052 CET	1.1.1.1	192.168.2.5	0x5a95	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.14	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:20.199933052 CET	1.1.1.1	192.168.2.5	0x5a95	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:20.199933052 CET	1.1.1.1	192.168.2.5	0x5a95	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.68	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.355654955 CET	1.1.1.1	192.168.2.5	0x8b3f	No error (0)	google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.356432915 CET	1.1.1.1	192.168.2.5	0xb26b	No error (0)	google.com		172.253.115.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.362011909 CET	1.1.1.1	192.168.2.5	0xad6d	No error (0)	accounts.google.com		172.253.122.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:22.853075981 CET	1.1.1.1	192.168.2.5	0xd3f5	No error (0)	www3.doubleclick.net		142.251.167.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.442399025 CET	1.1.1.1	192.168.2.5	0x72e1	No error (0)	www.google.com		142.251.163.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.443028927 CET	1.1.1.1	192.168.2.5	0xc5d1	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:23.519732952 CET	1.1.1.1	192.168.2.5	0x1ba9	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:23.519732952 CET	1.1.1.1	192.168.2.5	0x1ba9	No error (0)	securepubads46.g.doubleclick.net		142.251.16.156	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.519732952 CET	1.1.1.1	192.168.2.5	0x1ba9	No error (0)	securepubads46.g.doubleclick.net		142.251.16.157	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:23.520342112 CET	1.1.1.1	192.168.2.5	0x5189	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:23.549390078 CET	1.1.1.1	192.168.2.5	0xf059	No error (0)	pagead-googlehosted.l.google.com		142.250.31.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.467809916 CET	1.1.1.1	192.168.2.5	0x7e76	No error (0)	sc-static.net		3.162.129.245	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.505990982 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	s.pinimg.com	s-pinimg-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:24.505990982 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	s-pinimg-com.gslb.pinterest.com	static.gslb.pinterest.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:24.505990982 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	static.gslb.pinterest.net	dualstack.pinterest.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:24.505990982 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	dualstack.pinterest.map.fastly.net		146.75.28.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.507349014 CET	1.1.1.1	192.168.2.5	0xc5a2	No error (0)	s.pinimg.com	s-pinimg-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:24.507349014 CET	1.1.1.1	192.168.2.5	0xc5a2	No error (0)	s-pinimg-com.gslb.pinterest.com	2-01-37d2-0020.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:24.508769035 CET	1.1.1.1	192.168.2.5	0x53b6	No error (0)	td.doubleclick.net		172.253.115.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.508769035 CET	1.1.1.1	192.168.2.5	0x53b6	No error (0)	td.doubleclick.net		172.253.115.156	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.510215044 CET	1.1.1.1	192.168.2.5	0xad49	No error (0)	googleads.g.doubleclick.net		172.253.62.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.510215044 CET	1.1.1.1	192.168.2.5	0xad49	No error (0)	googleads.g.doubleclick.net		172.253.62.157	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.510436058 CET	1.1.1.1	192.168.2.5	0x6876	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:24.933578014 CET	1.1.1.1	192.168.2.5	0x3d34	No error (0)	marketingplatform.google.com		172.253.63.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.011734962 CET	1.1.1.1	192.168.2.5	0x6e3a	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:16:25.011895895 CET	1.1.1.1	192.168.2.5	0x441e	No error (0)	ad.doubleclick.net		142.251.163.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.011895895 CET	1.1.1.1	192.168.2.5	0x441e	No error (0)	ad.doubleclick.net		142.251.163.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.764223099 CET	1.1.1.1	192.168.2.5	0x21a2	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:25.764223099 CET	1.1.1.1	192.168.2.5	0x21a2	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.68	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.764223099 CET	1.1.1.1	192.168.2.5	0x21a2	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.14	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.764223099 CET	1.1.1.1	192.168.2.5	0x21a2	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.78	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.764223099 CET	1.1.1.1	192.168.2.5	0x21a2	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		108.138.85.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.768815994 CET	1.1.1.1	192.168.2.5	0x9452	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:25.768815994 CET	1.1.1.1	192.168.2.5	0x9452	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.80	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.15	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.773526907 CET	1.1.1.1	192.168.2.5	0x771e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:25.784884930 CET	1.1.1.1	192.168.2.5	0x4ff0	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:26.056552887 CET	1.1.1.1	192.168.2.5	0x18e	No error (0)	gtm-mktg.booking.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.056552887 CET	1.1.1.1	192.168.2.5	0x18e	No error (0)	gtm-mktg.booking.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.056552887 CET	1.1.1.1	192.168.2.5	0x18e	No error (0)	gtm-mktg.booking.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.056552887 CET	1.1.1.1	192.168.2.5	0x18e	No error (0)	gtm-mktg.booking.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300321102 CET	1.1.1.1	192.168.2.5	0xcc04	No error (0)	www.google.com		142.251.163.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:26.300720930 CET	1.1.1.1	192.168.2.5	0x23cb	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:27.481066942 CET	1.1.1.1	192.168.2.5	0xffb2	No error (0)	ad.doubleclick.net		142.251.163.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.481066942 CET	1.1.1.1	192.168.2.5	0xffb2	No error (0)	ad.doubleclick.net		142.251.163.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.482022047 CET	1.1.1.1	192.168.2.5	0x38d1	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:16:27.498476028 CET	1.1.1.1	192.168.2.5	0xb70d	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.498476028 CET	1.1.1.1	192.168.2.5	0xb70d	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.498476028 CET	1.1.1.1	192.168.2.5	0xb70d	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.499438047 CET	1.1.1.1	192.168.2.5	0xbc5d	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.499438047 CET	1.1.1.1	192.168.2.5	0xbc5d	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.503031969 CET	1.1.1.1	192.168.2.5	0x6568	No error (0)	adservice.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:27.503633976 CET	1.1.1.1	192.168.2.5	0xf0d6	No error (0)	adservice.google.com		172.253.63.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.503633976 CET	1.1.1.1	192.168.2.5	0xf0d6	No error (0)	adservice.google.com		172.253.63.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	www-pinterest-com.gslb.pinterest.com	www.gslb.pinterest.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	www.gslb.pinterest.net	prod.pinterest.global.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519784927 CET	1.1.1.1	192.168.2.5	0x3e70	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519845963 CET	1.1.1.1	192.168.2.5	0xc9bc	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519845963 CET	1.1.1.1	192.168.2.5	0xc9bc	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519845963 CET	1.1.1.1	192.168.2.5	0xc9bc	No error (0)	www-pinterest-com.gslb.pinterest.com	www.gslb.pinterest.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.519845963 CET	1.1.1.1	192.168.2.5	0xc9bc	No error (0)	www.gslb.pinterest.net	prod.pinterest.global.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.695864916 CET	1.1.1.1	192.168.2.5	0x4a1c	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.695864916 CET	1.1.1.1	192.168.2.5	0x4a1c	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.695864916 CET	1.1.1.1	192.168.2.5	0x4a1c	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.696314096 CET	1.1.1.1	192.168.2.5	0x4f17	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.696314096 CET	1.1.1.1	192.168.2.5	0x4f17	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.835757971 CET	1.1.1.1	192.168.2.5	0x9141	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.835757971 CET	1.1.1.1	192.168.2.5	0x9141	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.15	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.839138031 CET	1.1.1.1	192.168.2.5	0x4bde	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.80	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.870405912 CET	1.1.1.1	192.168.2.5	0x42d7	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.870405912 CET	1.1.1.1	192.168.2.5	0x42d7	No error (0)	securepubads46.g.doubleclick.net		142.251.111.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.870405912 CET	1.1.1.1	192.168.2.5	0x42d7	No error (0)	securepubads46.g.doubleclick.net		142.251.111.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.871275902 CET	1.1.1.1	192.168.2.5	0x562c	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:27.878201008 CET	1.1.1.1	192.168.2.5	0x6374	No error (0)	marketingplatform.google.com		172.253.122.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.411796093 CET	1.1.1.1	192.168.2.5	0xe2aa	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.412564993 CET	1.1.1.1	192.168.2.5	0xb2a8	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.412564993 CET	1.1.1.1	192.168.2.5	0xb2a8	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.412564993 CET	1.1.1.1	192.168.2.5	0xb2a8	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.684885979 CET	1.1.1.1	192.168.2.5	0xe53b	No error (0)	analytics.google.com		172.253.63.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:28.687239885 CET	1.1.1.1	192.168.2.5	0x451c	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.859533072 CET	1.1.1.1	192.168.2.5	0xa058	No error (0)	tr6.snapchat.com	usc1-gcp-v61.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.859946012 CET	1.1.1.1	192.168.2.5	0x5b29	No error (0)	tr6.snapchat.com	usc1-gcp-v61.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:28.859946012 CET	1.1.1.1	192.168.2.5	0x5b29	No error (0)	usc1-gcp-v61.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:29.017309904 CET	1.1.1.1	192.168.2.5	0xf79d	No error (0)	sc-static.net		3.162.129.245	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:30.567544937 CET	1.1.1.1	192.168.2.5	0x4a7d	No error (0)	pixel.tapad.com		34.111.113.62	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.123792887 CET	1.1.1.1	192.168.2.5	0x86be	No error (0)	ad.doubleclick.net		172.253.115.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.123792887 CET	1.1.1.1	192.168.2.5	0x86be	No error (0)	ad.doubleclick.net		172.253.115.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.124212027 CET	1.1.1.1	192.168.2.5	0xe2cf	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:16:31.125650883 CET	1.1.1.1	192.168.2.5	0xe85b	No error (0)	gtm-mktg.booking.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.125650883 CET	1.1.1.1	192.168.2.5	0xe85b	No error (0)	gtm-mktg.booking.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.125650883 CET	1.1.1.1	192.168.2.5	0xe85b	No error (0)	gtm-mktg.booking.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.125650883 CET	1.1.1.1	192.168.2.5	0xe85b	No error (0)	gtm-mktg.booking.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.606245995 CET	1.1.1.1	192.168.2.5	0x6352	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.609769106 CET	1.1.1.1	192.168.2.5	0xf5ac	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.609769106 CET	1.1.1.1	192.168.2.5	0xf5ac	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.609769106 CET	1.1.1.1	192.168.2.5	0xf5ac	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.652765036 CET	1.1.1.1	192.168.2.5	0xdca7	No error (0)	adservice.google.com		172.253.62.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.652765036 CET	1.1.1.1	192.168.2.5	0xdca7	No error (0)	adservice.google.com		172.253.62.157	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.652802944 CET	1.1.1.1	192.168.2.5	0x9a7d	No error (0)	adservice.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:31.668457985 CET	1.1.1.1	192.168.2.5	0x6c4f	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.668457985 CET	1.1.1.1	192.168.2.5	0x6c4f	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.668457985 CET	1.1.1.1	192.168.2.5	0x6c4f	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.669835091 CET	1.1.1.1	192.168.2.5	0x9b4f	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.669835091 CET	1.1.1.1	192.168.2.5	0x9b4f	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.720410109 CET	1.1.1.1	192.168.2.5	0x1385	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.720410109 CET	1.1.1.1	192.168.2.5	0x1385	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.80	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.15	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:31.724725008 CET	1.1.1.1	192.168.2.5	0xc39d	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.930116892 CET	1.1.1.1	192.168.2.5	0x76bb	No error (0)	web-perf.booking.com	d32jgtbwout526.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:32.930116892 CET	1.1.1.1	192.168.2.5	0x76bb	No error (0)	d32jgtbwout526.cloudfront.net		13.32.151.4	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.930116892 CET	1.1.1.1	192.168.2.5	0x76bb	No error (0)	d32jgtbwout526.cloudfront.net		13.32.151.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.930116892 CET	1.1.1.1	192.168.2.5	0x76bb	No error (0)	d32jgtbwout526.cloudfront.net		13.32.151.89	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.930116892 CET	1.1.1.1	192.168.2.5	0x76bb	No error (0)	d32jgtbwout526.cloudfront.net		13.32.151.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:32.942193985 CET	1.1.1.1	192.168.2.5	0x8d1	No error (0)	web-perf.booking.com	d32jgtbwout526.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:36.390563965 CET	1.1.1.1	192.168.2.5	0xdcb3	No error (0)	windowsupdatebg.s.llnwi.net		69.164.0.128	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.446962118 CET	1.1.1.1	192.168.2.5	0x19fd	No error (0)	google.com		172.253.115.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.447412968 CET	1.1.1.1	192.168.2.5	0xe00	No error (0)	google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:37.447858095 CET	1.1.1.1	192.168.2.5	0x5691	No error (0)	accounts.google.com		142.251.167.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:37.929352999 CET	1.1.1.1	192.168.2.5	0x2533	No error (0)	pagead-googlehosted.l.google.com		172.253.63.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.052912951 CET	1.1.1.1	192.168.2.5	0x4c29	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:38.053194046 CET	1.1.1.1	192.168.2.5	0xab4f	No error (0)	www.google.com		172.253.122.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:39.027612925 CET	1.1.1.1	192.168.2.5	0x23de	No error (0)	ad.doubleclick.net		172.253.115.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:39.027612925 CET	1.1.1.1	192.168.2.5	0x23de	No error (0)	ad.doubleclick.net		172.253.115.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:39.027827024 CET	1.1.1.1	192.168.2.5	0x5300	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:16:47.178097963 CET	1.1.1.1	192.168.2.5	0x3e3b	No error (0)	google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:47.178746939 CET	1.1.1.1	192.168.2.5	0x30be	No error (0)	accounts.google.com		172.253.115.84	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.138	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.178786039 CET	1.1.1.1	192.168.2.5	0x8bf3	No error (0)	google.com		172.253.63.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.103	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758249998 CET	1.1.1.1	192.168.2.5	0x336b	No error (0)	www.google.com		172.253.122.147	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:47.758363008 CET	1.1.1.1	192.168.2.5	0xf440	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:16:47.836524010 CET	1.1.1.1	192.168.2.5	0xdaad	No error (0)	pagead-googlehosted.l.google.com		172.253.63.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:48.839617014 CET	1.1.1.1	192.168.2.5	0x3bfa	No error (0)	www.googletagservices.com		142.251.111.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:48.839617014 CET	1.1.1.1	192.168.2.5	0x3bfa	No error (0)	www.googletagservices.com		142.251.111.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:48.840270996 CET	1.1.1.1	192.168.2.5	0xf083	No error (0)	z.moatads.com	wildcard.moatads.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:48.840540886 CET	1.1.1.1	192.168.2.5	0x6373	No error (0)	z.moatads.com	wildcard.moatads.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:16:49.825414896 CET	1.1.1.1	192.168.2.5	0xa742	No error (0)	ad.doubleclick.net		172.253.115.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:49.825414896 CET	1.1.1.1	192.168.2.5	0xa742	No error (0)	ad.doubleclick.net		172.253.115.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:16:49.825686932 CET	1.1.1.1	192.168.2.5	0x6708	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:17:01.451839924 CET	1.1.1.1	192.168.2.5	0xe8ba	No error (0)	secure.booking.com	d2pgys3db91n8r.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:01.465152979 CET	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	secure.booking.com	d2pgys3db91n8r.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:01.465152979 CET	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	d2pgys3db91n8r.cloudfront.net		18.173.219.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:01.465152979 CET	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	d2pgys3db91n8r.cloudfront.net		18.173.219.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:01.465152979 CET	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	d2pgys3db91n8r.cloudfront.net		18.173.219.110	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:01.465152979 CET	1.1.1.1	192.168.2.5	0x1c5e	No error (0)	d2pgys3db91n8r.cloudfront.net		18.173.219.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.890790939 CET	1.1.1.1	192.168.2.5	0xaaf4	No error (0)	secure.booking.com	d2pgys3db91n8r.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:06.890790939 CET	1.1.1.1	192.168.2.5	0xaaf4	No error (0)	d2pgys3db91n8r.cloudfront.net		108.138.85.49	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.890790939 CET	1.1.1.1	192.168.2.5	0xaaf4	No error (0)	d2pgys3db91n8r.cloudfront.net		108.138.85.39	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.890790939 CET	1.1.1.1	192.168.2.5	0xaaf4	No error (0)	d2pgys3db91n8r.cloudfront.net		108.138.85.7	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.890790939 CET	1.1.1.1	192.168.2.5	0xaaf4	No error (0)	d2pgys3db91n8r.cloudfront.net		108.138.85.51	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:06.891532898 CET	1.1.1.1	192.168.2.5	0xc3fd	No error (0)	secure.booking.com	d2pgys3db91n8r.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:08.483486891 CET	1.1.1.1	192.168.2.5	0x49a6	No error (0)	join.booking.com	d2jothlt68ryaj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:08.486969948 CET	1.1.1.1	192.168.2.5	0xb648	No error (0)	join.booking.com	d2jothlt68ryaj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:08.486969948 CET	1.1.1.1	192.168.2.5	0xb648	No error (0)	d2jothlt68ryaj.cloudfront.net		18.164.96.33	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:08.486969948 CET	1.1.1.1	192.168.2.5	0xb648	No error (0)	d2jothlt68ryaj.cloudfront.net		18.164.96.57	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:08.486969948 CET	1.1.1.1	192.168.2.5	0xb648	No error (0)	d2jothlt68ryaj.cloudfront.net		18.164.96.44	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:08.486969948 CET	1.1.1.1	192.168.2.5	0xb648	No error (0)	d2jothlt68ryaj.cloudfront.net		18.164.96.102	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.711983919 CET	1.1.1.1	192.168.2.5	0x46a	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:09.711983919 CET	1.1.1.1	192.168.2.5	0x46a	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.711983919 CET	1.1.1.1	192.168.2.5	0x46a	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.711983919 CET	1.1.1.1	192.168.2.5	0x46a	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.711983919 CET	1.1.1.1	192.168.2.5	0x46a	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:09.715563059 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.527988911 CET	1.1.1.1	192.168.2.5	0xdb2a	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.527988911 CET	1.1.1.1	192.168.2.5	0xdb2a	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.527988911 CET	1.1.1.1	192.168.2.5	0xdb2a	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:11.529644966 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.110271931 CET	1.1.1.1	192.168.2.5	0x34ab	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.180222034 CET	1.1.1.1	192.168.2.5	0x3b7e	No error (0)	booking.com		13.249.39.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.180222034 CET	1.1.1.1	192.168.2.5	0x3b7e	No error (0)	booking.com		13.249.39.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.180222034 CET	1.1.1.1	192.168.2.5	0x3b7e	No error (0)	booking.com		13.249.39.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.180222034 CET	1.1.1.1	192.168.2.5	0x3b7e	No error (0)	booking.com		13.249.39.92	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.190274000 CET	1.1.1.1	192.168.2.5	0x9721	No error (0)	q.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.190274000 CET	1.1.1.1	192.168.2.5	0x9721	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.190274000 CET	1.1.1.1	192.168.2.5	0x9721	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	q.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:13.226236105 CET	1.1.1.1	192.168.2.5	0xafc7	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.307919025 CET	1.1.1.1	192.168.2.5	0xa02d	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.307919025 CET	1.1.1.1	192.168.2.5	0xa02d	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.307919025 CET	1.1.1.1	192.168.2.5	0xa02d	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.308403015 CET	1.1.1.1	192.168.2.5	0xc288	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.386619091 CET	1.1.1.1	192.168.2.5	0x646	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.387468100 CET	1.1.1.1	192.168.2.5	0xf740	No error (0)	booking.com		13.249.39.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.387468100 CET	1.1.1.1	192.168.2.5	0xf740	No error (0)	booking.com		13.249.39.92	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.387468100 CET	1.1.1.1	192.168.2.5	0xf740	No error (0)	booking.com		13.249.39.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.387468100 CET	1.1.1.1	192.168.2.5	0xf740	No error (0)	booking.com		13.249.39.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.398251057 CET	1.1.1.1	192.168.2.5	0x487c	No error (0)	join.booking.com	d2jothlt68ryaj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.402079105 CET	1.1.1.1	192.168.2.5	0x3d51	No error (0)	join.booking.com	d2jothlt68ryaj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.402079105 CET	1.1.1.1	192.168.2.5	0x3d51	No error (0)	d2jothlt68ryaj.cloudfront.net		99.84.191.14	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.402079105 CET	1.1.1.1	192.168.2.5	0x3d51	No error (0)	d2jothlt68ryaj.cloudfront.net		99.84.191.54	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.402079105 CET	1.1.1.1	192.168.2.5	0x3d51	No error (0)	d2jothlt68ryaj.cloudfront.net		99.84.191.20	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.402079105 CET	1.1.1.1	192.168.2.5	0x3d51	No error (0)	d2jothlt68ryaj.cloudfront.net		99.84.191.49	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	q.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.426156044 CET	1.1.1.1	192.168.2.5	0x6881	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:14.432126999 CET	1.1.1.1	192.168.2.5	0x52f2	No error (0)	q.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.432126999 CET	1.1.1.1	192.168.2.5	0x52f2	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:14.432126999 CET	1.1.1.1	192.168.2.5	0x52f2	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:15.158627987 CET	1.1.1.1	192.168.2.5	0xe501	No error (0)	11963210.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:15.158627987 CET	1.1.1.1	192.168.2.5	0xe501	No error (0)	dart.l.doubleclick.net		142.251.16.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.158627987 CET	1.1.1.1	192.168.2.5	0xe501	No error (0)	dart.l.doubleclick.net		142.251.16.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.159077883 CET	1.1.1.1	192.168.2.5	0x9ec6	No error (0)	11963210.fls.doubleclick.net	dart.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:15.197940111 CET	1.1.1.1	192.168.2.5	0xdeb0	No error (0)	dynamic.criteo.com	dynamic.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:15.197940111 CET	1.1.1.1	192.168.2.5	0xdeb0	No error (0)	dynamic.va1.vip.prod.criteo.com		74.119.119.142	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.200833082 CET	1.1.1.1	192.168.2.5	0x7478	No error (0)	dynamic.criteo.com	dynamic.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:15.796919107 CET	1.1.1.1	192.168.2.5	0xeabb	No error (0)	ad.doubleclick.net		172.253.62.148	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.796919107 CET	1.1.1.1	192.168.2.5	0xeabb	No error (0)	ad.doubleclick.net		172.253.62.149	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:15.797723055 CET	1.1.1.1	192.168.2.5	0x31eb	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Jan 16, 2024 00:17:16.059804916 CET	1.1.1.1	192.168.2.5	0x30d8	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:16.059804916 CET	1.1.1.1	192.168.2.5	0x30d8	No error (0)	gum.va1.vip.prod.criteo.com		74.119.119.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.060089111 CET	1.1.1.1	192.168.2.5	0xb27e	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:16.938653946 CET	1.1.1.1	192.168.2.5	0x510b	No error (0)	adservice.google.com			65	IN (0x0001)	false
Jan 16, 2024 00:17:16.938884974 CET	1.1.1.1	192.168.2.5	0x74a	No error (0)	adservice.google.com		172.253.63.154	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.938884974 CET	1.1.1.1	192.168.2.5	0x74a	No error (0)	adservice.google.com		172.253.63.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.984416008 CET	1.1.1.1	192.168.2.5	0x9ddc	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:16.984416008 CET	1.1.1.1	192.168.2.5	0x9ddc	No error (0)	gum.va1.vip.prod.criteo.com		74.119.119.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.984659910 CET	1.1.1.1	192.168.2.5	0xd89c	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:16.993108034 CET	1.1.1.1	192.168.2.5	0x9e24	No error (0)	sslwidget.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:16.993108034 CET	1.1.1.1	192.168.2.5	0x9e24	No error (0)	widget.va1.vip.prod.criteo.com		74.119.119.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:16.993283987 CET	1.1.1.1	192.168.2.5	0xe991	No error (0)	sslwidget.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.520625114 CET	1.1.1.1	192.168.2.5	0xba54	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.520724058 CET	1.1.1.1	192.168.2.5	0xa713	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.520724058 CET	1.1.1.1	192.168.2.5	0xa713	No error (0)	measurement-api.va1.vip.prod.criteo.com		74.119.119.71	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.555243969 CET	1.1.1.1	192.168.2.5	0xb540	No error (0)	fledge.us.criteo.com	fledge.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.555260897 CET	1.1.1.1	192.168.2.5	0x20e	No error (0)	fledge.us.criteo.com	fledge.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.555260897 CET	1.1.1.1	192.168.2.5	0x20e	No error (0)	fledge.va1.vip.prod.criteo.com		74.119.119.74	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.571965933 CET	1.1.1.1	192.168.2.5	0xffc	No error (0)	cm.g.doubleclick.net		172.253.115.156	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.571965933 CET	1.1.1.1	192.168.2.5	0xffc	No error (0)	cm.g.doubleclick.net		172.253.115.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.573154926 CET	1.1.1.1	192.168.2.5	0xd52c	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.573801041 CET	1.1.1.1	192.168.2.5	0xc9ce	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.573801041 CET	1.1.1.1	192.168.2.5	0xc9ce	No error (0)	user-data-us-east.bidswitch.net		35.211.178.172	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574321985 CET	1.1.1.1	192.168.2.5	0x3177	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	partner.mediawallahscript.com	pcs3prod18.us-east-1.elasticbeanstalk.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	pcs3prod18.us-east-1.elasticbeanstalk.com		3.224.246.109	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	pcs3prod18.us-east-1.elasticbeanstalk.com		52.86.33.22	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	pcs3prod18.us-east-1.elasticbeanstalk.com		44.206.54.3	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	pcs3prod18.us-east-1.elasticbeanstalk.com		18.206.31.226	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.574338913 CET	1.1.1.1	192.168.2.5	0x2690	No error (0)	pcs3prod18.us-east-1.elasticbeanstalk.com		3.213.247.157	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.575975895 CET	1.1.1.1	192.168.2.5	0x8984	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576562881 CET	1.1.1.1	192.168.2.5	0x299e	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576562881 CET	1.1.1.1	192.168.2.5	0x299e	No error (0)	rtb-csync-use2.smartadserver.com		147.135.94.221	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576562881 CET	1.1.1.1	192.168.2.5	0x299e	No error (0)	rtb-csync-use2.smartadserver.com		135.148.2.57	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576562881 CET	1.1.1.1	192.168.2.5	0x299e	No error (0)	rtb-csync-use2.smartadserver.com		135.148.2.56	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576562881 CET	1.1.1.1	192.168.2.5	0x299e	No error (0)	rtb-csync-use2.smartadserver.com		147.135.94.220	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.576585054 CET	1.1.1.1	192.168.2.5	0x2b1d	No error (0)	contextual.media.net		23.209.60.28	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.577030897 CET	1.1.1.1	192.168.2.5	0x880f	No error (0)	partner.mediawallahscript.com	pcs3prod18.us-east-1.elasticbeanstalk.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.577564001 CET	1.1.1.1	192.168.2.5	0xa82c	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.577588081 CET	1.1.1.1	192.168.2.5	0xd488	No error (0)	sync-t1.taboola.com	us-vip001.taboola.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.578125954 CET	1.1.1.1	192.168.2.5	0xae02	No error (0)	criteo-sync.teads.tv	criteo-sync.teads.tv.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.578305960 CET	1.1.1.1	192.168.2.5	0x8536	No error (0)	sync-t1.taboola.com	us-vip001.taboola.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.578305960 CET	1.1.1.1	192.168.2.5	0x8536	No error (0)	us-vip001.taboola.com		141.226.224.48	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579051971 CET	1.1.1.1	192.168.2.5	0xbed6	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579051971 CET	1.1.1.1	192.168.2.5	0xbed6	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579744101 CET	1.1.1.1	192.168.2.5	0x43ff	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579744101 CET	1.1.1.1	192.168.2.5	0x43ff	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579744101 CET	1.1.1.1	192.168.2.5	0x43ff	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579744101 CET	1.1.1.1	192.168.2.5	0x43ff	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:17.579760075 CET	1.1.1.1	192.168.2.5	0xda78	No error (0)	criteo-sync.teads.tv	criteo-sync.teads.tv.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:17.582576990 CET	1.1.1.1	192.168.2.5	0xbdcf	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.018904924 CET	1.1.1.1	192.168.2.5	0xc9b4	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.018904924 CET	1.1.1.1	192.168.2.5	0xc9b4	No error (0)	measurement-api.va1.vip.prod.criteo.com		74.119.119.71	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.019555092 CET	1.1.1.1	192.168.2.5	0x9e83	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.034002066 CET	1.1.1.1	192.168.2.5	0x3215	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.034276009 CET	1.1.1.1	192.168.2.5	0xf46f	No error (0)	measurement-api.criteo.com	measurement-api.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.034276009 CET	1.1.1.1	192.168.2.5	0xf46f	No error (0)	measurement-api.va1.vip.prod.criteo.com		74.119.119.71	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.187125921 CET	1.1.1.1	192.168.2.5	0x2bd9	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.187125921 CET	1.1.1.1	192.168.2.5	0x2bd9	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.187125921 CET	1.1.1.1	192.168.2.5	0x2bd9	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.188061953 CET	1.1.1.1	192.168.2.5	0x8b9b	No error (0)	ups.analytics.yahoo.com	prod.ups-ats.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.188061953 CET	1.1.1.1	192.168.2.5	0x8b9b	No error (0)	prod.ups-ats.aolp-ds-prd.aws.oath.cloud	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.188061953 CET	1.1.1.1	192.168.2.5	0x8b9b	No error (0)	prod.ups-ats.us-east-1.aolp-ds-prd.aws.oath.cloud	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.188061953 CET	1.1.1.1	192.168.2.5	0x8b9b	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		34.200.65.202	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.188061953 CET	1.1.1.1	192.168.2.5	0x8b9b	No error (0)	ats-eks.us-east-1.dcs-online-targeting-prd.aws.oath.cloud		3.225.218.10	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.91	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.98	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.96	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.190097094 CET	1.1.1.1	192.168.2.5	0x8942	No error (0)	hb.yahoo.net		23.58.127.115	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.191961050 CET	1.1.1.1	192.168.2.5	0x914e	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.191961050 CET	1.1.1.1	192.168.2.5	0x914e	No error (0)	widget.va1.vip.prod.criteo.com		74.119.119.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.191979885 CET	1.1.1.1	192.168.2.5	0x51c4	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.209105015 CET	1.1.1.1	192.168.2.5	0xf8e1	No error (0)	visitor.omnitagjs.com	visitor-usa02.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.209105015 CET	1.1.1.1	192.168.2.5	0xf8e1	No error (0)	visitor-usa02.omnitagjs.com		195.244.31.10	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.209105015 CET	1.1.1.1	192.168.2.5	0xf8e1	No error (0)	visitor-usa02.omnitagjs.com		195.244.31.11	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.210016966 CET	1.1.1.1	192.168.2.5	0x9711	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.229018927 CET	1.1.1.1	192.168.2.5	0x4a6a	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.229137897 CET	1.1.1.1	192.168.2.5	0x94cf	No error (0)	pixel.rubiconproject.com	pixel.rubiconproject.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.229377031 CET	1.1.1.1	192.168.2.5	0x46d7	No error (0)	sync-t1.taboola.com	us-vip001.taboola.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.229377031 CET	1.1.1.1	192.168.2.5	0x46d7	No error (0)	us-vip001.taboola.com		141.226.224.48	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.121	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.56	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.136	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.172	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.73	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.173	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.8	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.14.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.41	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.120	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.14.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		23.105.12.151	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.40	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.72	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235320091 CET	1.1.1.1	192.168.2.5	0xe395	No error (0)	rtb-csync-use1.smartadserver.com		216.22.16.57	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235439062 CET	1.1.1.1	192.168.2.5	0xb892	No error (0)	sync-t1.taboola.com	us-vip001.taboola.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.235975027 CET	1.1.1.1	192.168.2.5	0xac63	No error (0)	rtb-csync.smartadserver.com	rtb-csync-geo.usersync-prod-sas.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.323045969 CET	1.1.1.1	192.168.2.5	0xad7d	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		13.225.195.71	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.323045969 CET	1.1.1.1	192.168.2.5	0xad7d	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		13.225.195.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.323045969 CET	1.1.1.1	192.168.2.5	0xad7d	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		13.225.195.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.323045969 CET	1.1.1.1	192.168.2.5	0xad7d	No error (0)	d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com		13.225.195.53	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.339584112 CET	1.1.1.1	192.168.2.5	0xa90b	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.339584112 CET	1.1.1.1	192.168.2.5	0xa90b	No error (0)	gum.va1.vip.prod.criteo.com		74.119.119.139	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.339993954 CET	1.1.1.1	192.168.2.5	0x9659	No error (0)	gum.criteo.com	gum.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.341116905 CET	1.1.1.1	192.168.2.5	0x9d57	No error (0)	r.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.341116905 CET	1.1.1.1	192.168.2.5	0x9d57	No error (0)	r.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.342741013 CET	1.1.1.1	192.168.2.5	0x6630	No error (0)	r.casalemedia.com			65	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	secure.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.24	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.181.211	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.75	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.161.182	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.687567949 CET	1.1.1.1	192.168.2.5	0x5c44	No error (0)	ib.anycast.adnxs.com		68.67.179.166	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.781003952 CET	1.1.1.1	192.168.2.5	0xfee6	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.781995058 CET	1.1.1.1	192.168.2.5	0xce81	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		44.215.44.145	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		3.84.63.197	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		34.203.71.171	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		34.199.246.174	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		34.193.27.58	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		3.209.75.23	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		54.221.205.230	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.796303034 CET	1.1.1.1	192.168.2.5	0x555a	No error (0)	na-ice.360yield.com		34.202.191.251	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797187090 CET	1.1.1.1	192.168.2.5	0xe81d	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797187090 CET	1.1.1.1	192.168.2.5	0xe81d	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797456026 CET	1.1.1.1	192.168.2.5	0x39fa	No error (0)	i.liadm.com	idaas-ext.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	i.liadm.com	idaas-ext.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		3.90.211.105	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		54.90.95.251	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		34.232.39.24	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		52.1.112.24	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		34.225.109.145	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		34.224.244.32	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		3.230.211.34	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.797477007 CET	1.1.1.1	192.168.2.5	0xb2e8	No error (0)	idaas-ext.cph.liveintent.com		54.91.189.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.840945959 CET	1.1.1.1	192.168.2.5	0x4fef	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.841418982 CET	1.1.1.1	192.168.2.5	0x40be	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		54.224.27.48	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		3.234.138.61	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		54.165.1.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		34.195.115.14	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		52.54.197.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.884113073 CET	1.1.1.1	192.168.2.5	0x8547	No error (0)	exchange.mediavine.com		54.198.189.169	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.924272060 CET	1.1.1.1	192.168.2.5	0x4bd1	No error (0)	criteo-sync.teads.tv	criteo-sync.teads.tv.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.924586058 CET	1.1.1.1	192.168.2.5	0xf565	No error (0)	criteo-sync.teads.tv	criteo-sync.teads.tv.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.927544117 CET	1.1.1.1	192.168.2.5	0x94f2	No error (0)	contextual.media.net		23.222.200.28	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:18.999808073 CET	1.1.1.1	192.168.2.5	0x4076	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:18.999808073 CET	1.1.1.1	192.168.2.5	0x4076	No error (0)	user-data-us-east.bidswitch.net		35.211.178.172	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.000519991 CET	1.1.1.1	192.168.2.5	0x8f4b	No error (0)	x.bidswitch.net	user-data-us-east.bidswitch.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.017365932 CET	1.1.1.1	192.168.2.5	0x839d	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.017365932 CET	1.1.1.1	192.168.2.5	0x839d	No error (0)	widget.va1.vip.prod.criteo.com		74.119.119.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.017959118 CET	1.1.1.1	192.168.2.5	0x1162	No error (0)	dis.criteo.com	widget.va1.vip.prod.criteo.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		52.40.188.60	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		52.37.77.97	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		54.244.23.119	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		34.217.248.81	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		44.241.124.199	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		54.245.116.245	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		35.160.51.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.021498919 CET	1.1.1.1	192.168.2.5	0x539d	No error (0)	visitor-us-west-2.omnitagjs.com		52.40.88.221	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.022763968 CET	1.1.1.1	192.168.2.5	0x699f	No error (0)	visitor.omnitagjs.com	visitor-us-west-2.omnitagjs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.176476955 CET	1.1.1.1	192.168.2.5	0x554f	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.176476955 CET	1.1.1.1	192.168.2.5	0x554f	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.176476955 CET	1.1.1.1	192.168.2.5	0x554f	No error (0)	us-east-eb2.3lift.com		35.71.139.29	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.176476955 CET	1.1.1.1	192.168.2.5	0x554f	No error (0)	us-east-eb2.3lift.com		52.223.22.214	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.177556992 CET	1.1.1.1	192.168.2.5	0x99c2	No error (0)	eb2.3lift.com	na-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.177556992 CET	1.1.1.1	192.168.2.5	0x99c2	No error (0)	na-eb2.3lift.com	us-east-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.301516056 CET	1.1.1.1	192.168.2.5	0x7ec7	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.302845001 CET	1.1.1.1	192.168.2.5	0x5076	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.798185110 CET	1.1.1.1	192.168.2.5	0x57e3	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.798185110 CET	1.1.1.1	192.168.2.5	0x57e3	No error (0)	alldcs.outbrain.org	chidc2.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.798185110 CET	1.1.1.1	192.168.2.5	0x57e3	No error (0)	chidc2.outbrain.org		50.31.142.223	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.798851013 CET	1.1.1.1	192.168.2.5	0x4812	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.798851013 CET	1.1.1.1	192.168.2.5	0x4812	No error (0)	alldcs.outbrain.org	nydc1.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.799582958 CET	1.1.1.1	192.168.2.5	0x9de4	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.799582958 CET	1.1.1.1	192.168.2.5	0x9de4	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.799582958 CET	1.1.1.1	192.168.2.5	0x9de4	No error (0)	pug-vac.pubmnet.com		8.28.7.83	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.801506996 CET	1.1.1.1	192.168.2.5	0x230e	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.801506996 CET	1.1.1.1	192.168.2.5	0x230e	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		3.226.158.19	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		52.204.171.89	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		52.201.6.220	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		52.72.21.140	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		34.198.159.38	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		52.201.104.25	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		34.193.193.20	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.804390907 CET	1.1.1.1	192.168.2.5	0xe462	No error (0)	sync.crwdcntrl.net		34.197.228.249	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		3.227.14.209	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		18.214.117.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		3.222.47.188	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		44.218.163.194	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		3.232.254.109	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.806139946 CET	1.1.1.1	192.168.2.5	0x740f	No error (0)	trends.revcontent.com		52.204.251.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		52.6.62.160	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		3.91.113.229	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		34.236.67.173	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		52.72.126.126	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		44.215.99.31	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		54.84.78.68	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		34.235.32.60	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.819293976 CET	1.1.1.1	192.168.2.5	0xd719	No error (0)	match-us-east-1-ecs.sharethrough.com		52.71.125.247	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.820441961 CET	1.1.1.1	192.168.2.5	0x6037	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.881583929 CET	1.1.1.1	192.168.2.5	0xb0f2	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:19.881583929 CET	1.1.1.1	192.168.2.5	0xb0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.125	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.881583929 CET	1.1.1.1	192.168.2.5	0xb0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.12	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.881583929 CET	1.1.1.1	192.168.2.5	0xb0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.107	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.881583929 CET	1.1.1.1	192.168.2.5	0xb0f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		52.85.132.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:19.883586884 CET	1.1.1.1	192.168.2.5	0xd984	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.166049957 CET	1.1.1.1	192.168.2.5	0xdfd1	No error (0)	s.ad.smaato.net		18.67.76.69	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.166049957 CET	1.1.1.1	192.168.2.5	0xdfd1	No error (0)	s.ad.smaato.net		18.67.76.126	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.166049957 CET	1.1.1.1	192.168.2.5	0xdfd1	No error (0)	s.ad.smaato.net		18.67.76.70	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.166049957 CET	1.1.1.1	192.168.2.5	0xdfd1	No error (0)	s.ad.smaato.net		18.67.76.108	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.323090076 CET	1.1.1.1	192.168.2.5	0x62a3	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.324023008 CET	1.1.1.1	192.168.2.5	0x9bd	No error (0)	tags.bluekai.com	tags.bluekai.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.328782082 CET	1.1.1.1	192.168.2.5	0xc7b3	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.329535961 CET	1.1.1.1	192.168.2.5	0xd703	No error (0)	ads.stickyadstv.com	ip1.ads.stickyadstv.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.335195065 CET	1.1.1.1	192.168.2.5	0x4ee	No error (0)	r.casalemedia.com		172.64.151.101	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.335195065 CET	1.1.1.1	192.168.2.5	0x4ee	No error (0)	r.casalemedia.com		104.18.36.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.336745977 CET	1.1.1.1	192.168.2.5	0x354	No error (0)	r.casalemedia.com			65	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		3.234.138.61	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		54.165.1.37	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		34.195.115.14	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		54.198.189.169	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		54.224.27.48	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.339890957 CET	1.1.1.1	192.168.2.5	0x57a9	No error (0)	exchange.mediavine.com		52.54.197.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637788057 CET	1.1.1.1	192.168.2.5	0xc9b7	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637825966 CET	1.1.1.1	192.168.2.5	0x529f	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		35.171.143.90	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		34.198.208.133	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		54.90.89.241	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		34.206.60.153	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		23.20.176.142	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		3.217.20.217	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		3.223.218.249	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637926102 CET	1.1.1.1	192.168.2.5	0x5c41	No error (0)	na-ice.360yield.com		44.215.44.145	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637984991 CET	1.1.1.1	192.168.2.5	0xce6a	No error (0)	ad.360yield.com	ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.637984991 CET	1.1.1.1	192.168.2.5	0xce6a	No error (0)	ice.360yield.com	na-ice.360yield.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		3.227.14.209	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		3.222.47.188	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		18.214.117.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		44.218.163.194	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		52.204.251.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.650222063 CET	1.1.1.1	192.168.2.5	0x279e	No error (0)	trends.revcontent.com		3.232.254.109	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.652831078 CET	1.1.1.1	192.168.2.5	0x5bf7	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.652831078 CET	1.1.1.1	192.168.2.5	0x5bf7	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.652854919 CET	1.1.1.1	192.168.2.5	0xa82a	No error (0)	simage2.pubmatic.com	simage2v2.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.652854919 CET	1.1.1.1	192.168.2.5	0xa82a	No error (0)	simage2v2.pubmnet.com	pug-vac.pubmnet.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.652854919 CET	1.1.1.1	192.168.2.5	0xa82a	No error (0)	pug-vac.pubmnet.com		8.28.7.83	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		34.235.32.60	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		54.236.155.124	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		52.20.60.187	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		34.236.67.173	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		52.72.126.126	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		52.71.125.247	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		54.156.118.43	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656346083 CET	1.1.1.1	192.168.2.5	0x7c	No error (0)	match-us-east-1-ecs.sharethrough.com		52.22.66.5	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.656615019 CET	1.1.1.1	192.168.2.5	0x66e8	No error (0)	match.sharethrough.com	match-us-east-1-ecs.sharethrough.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.657380104 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.657380104 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	alldcs.outbrain.org	chidc2.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.657380104 CET	1.1.1.1	192.168.2.5	0x26a0	No error (0)	chidc2.outbrain.org		50.31.142.191	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:20.658293009 CET	1.1.1.1	192.168.2.5	0x2c0	No error (0)	sync.outbrain.com	alldcs.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:20.658293009 CET	1.1.1.1	192.168.2.5	0x2c0	No error (0)	alldcs.outbrain.org	chidc2.outbrain.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.195.167.11	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.239.196.136	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.223.28.32	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.233.8.30	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.224.154.119	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.211.50.210	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.152.188.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.101700068 CET	1.1.1.1	192.168.2.5	0xa40b	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.200.134.69	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.104742050 CET	1.1.1.1	192.168.2.5	0x7fc0	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.104742050 CET	1.1.1.1	192.168.2.5	0x7fc0	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.104742050 CET	1.1.1.1	192.168.2.5	0x7fc0	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.117002010 CET	1.1.1.1	192.168.2.5	0x75ec	No error (0)	1f2e7.v.fwmrm.net	g11v.fwgtm.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.adnxs.com	g.geo.appnexusgslb.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	g.geo.appnexusgslb.net	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.179.87	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.132	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.179.153	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.179.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.184	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.117	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.186	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.160.76	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.161.208	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.178.10	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.134913921 CET	1.1.1.1	192.168.2.5	0x8b3c	No error (0)	ib.anycast.adnxs.com		68.67.179.164	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.72	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.114	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.98	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.99	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.113	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.97	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.391088009 CET	1.1.1.1	192.168.2.5	0xa62e	No error (0)	hb.yahoo.net		23.58.127.74	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.536617041 CET	1.1.1.1	192.168.2.5	0x9178	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.536617041 CET	1.1.1.1	192.168.2.5	0x9178	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.536617041 CET	1.1.1.1	192.168.2.5	0x9178	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.536617041 CET	1.1.1.1	192.168.2.5	0x9178	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.541708946 CET	1.1.1.1	192.168.2.5	0xe130	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:21.541708946 CET	1.1.1.1	192.168.2.5	0xe130	No error (0)	idaas6.cph.liveintent.com		3.233.89.241	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.541708946 CET	1.1.1.1	192.168.2.5	0xe130	No error (0)	idaas6.cph.liveintent.com		54.172.56.55	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.541708946 CET	1.1.1.1	192.168.2.5	0xe130	No error (0)	idaas6.cph.liveintent.com		52.44.42.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:21.542068958 CET	1.1.1.1	192.168.2.5	0xb066	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.88.49.220	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.193.227.167	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		52.20.209.35	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		34.203.152.211	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		54.172.142.205	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.216.208.235	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		18.210.32.32	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.027832985 CET	1.1.1.1	192.168.2.5	0x4000	No error (0)	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		3.226.25.249	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.029514074 CET	1.1.1.1	192.168.2.5	0x3f09	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.029514074 CET	1.1.1.1	192.168.2.5	0x3f09	No error (0)	gslb-2.demdex.net	edge-va6.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.029514074 CET	1.1.1.1	192.168.2.5	0x3f09	No error (0)	edge-va6.demdex.net	dcs-public-edge-va6-158015560.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		52.86.139.62	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		54.165.113.212	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		54.157.227.4	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		52.86.222.201	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		54.146.199.23	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		52.70.39.35	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		52.6.152.202	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.043323994 CET	1.1.1.1	192.168.2.5	0x8be1	No error (0)	match.prod.bidr.io		52.73.63.104	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.057553053 CET	1.1.1.1	192.168.2.5	0x28c0	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.057553053 CET	1.1.1.1	192.168.2.5	0x28c0	No error (0)	idaas6.cph.liveintent.com		54.172.56.55	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.057553053 CET	1.1.1.1	192.168.2.5	0x28c0	No error (0)	idaas6.cph.liveintent.com		3.233.89.241	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.057553053 CET	1.1.1.1	192.168.2.5	0x28c0	No error (0)	idaas6.cph.liveintent.com		52.44.42.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.058222055 CET	1.1.1.1	192.168.2.5	0x826b	No error (0)	i6.liadm.com	idaas6.cph.liveintent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.773406982 CET	1.1.1.1	192.168.2.5	0xb526	No error (0)	static.criteo.net	static.va1.vip.prod.criteo.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.799657106 CET	1.1.1.1	192.168.2.5	0x1a7e	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:22.799657106 CET	1.1.1.1	192.168.2.5	0x1a7e	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.110	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.799657106 CET	1.1.1.1	192.168.2.5	0x1a7e	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.83	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.799657106 CET	1.1.1.1	192.168.2.5	0x1a7e	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.128	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.799657106 CET	1.1.1.1	192.168.2.5	0x1a7e	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.118	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:22.804338932 CET	1.1.1.1	192.168.2.5	0x7db1	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:23.217292070 CET	1.1.1.1	192.168.2.5	0x3740	No error (0)	ws.rqtrk.eu		51.222.241.145	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.217292070 CET	1.1.1.1	192.168.2.5	0x3740	No error (0)	ws.rqtrk.eu		51.222.241.106	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.217292070 CET	1.1.1.1	192.168.2.5	0x3740	No error (0)	ws.rqtrk.eu		51.222.241.100	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.519042015 CET	1.1.1.1	192.168.2.5	0x97c8	No error (0)	static.criteo.net	static.va1.vip.prod.criteo.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:23.519042015 CET	1.1.1.1	192.168.2.5	0x97c8	No error (0)	static.va1.vip.prod.criteo.net		74.119.119.131	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:23.532499075 CET	1.1.1.1	192.168.2.5	0x73b5	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:24.295700073 CET	1.1.1.1	192.168.2.5	0x2aa7	No error (0)	aa.agkn.com	d20qwf0wrdtevy.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:24.295700073 CET	1.1.1.1	192.168.2.5	0x2aa7	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.128	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.295700073 CET	1.1.1.1	192.168.2.5	0x2aa7	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.118	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.295700073 CET	1.1.1.1	192.168.2.5	0x2aa7	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.83	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.295700073 CET	1.1.1.1	192.168.2.5	0x2aa7	No error (0)	d20qwf0wrdtevy.cloudfront.net		13.249.39.110	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.330228090 CET	1.1.1.1	192.168.2.5	0x222b	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.330228090 CET	1.1.1.1	192.168.2.5	0x222b	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.330228090 CET	1.1.1.1	192.168.2.5	0x222b	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:24.330228090 CET	1.1.1.1	192.168.2.5	0x222b	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:25.382890940 CET	1.1.1.1	192.168.2.5	0xd978	No error (0)	cm.g.doubleclick.net		172.253.122.156	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:25.382890940 CET	1.1.1.1	192.168.2.5	0xd978	No error (0)	cm.g.doubleclick.net		172.253.122.155	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.80	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.47	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.15	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203638077 CET	1.1.1.1	192.168.2.5	0x8693	No error (0)	de2trjlt8e8rj.cloudfront.net		3.162.103.9	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203990936 CET	1.1.1.1	192.168.2.5	0x1bc5	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:26.203990936 CET	1.1.1.1	192.168.2.5	0x1bc5	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383203983 CET	1.1.1.1	192.168.2.5	0x13f2	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383203983 CET	1.1.1.1	192.168.2.5	0x13f2	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		34.206.227.189	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383203983 CET	1.1.1.1	192.168.2.5	0x13f2	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		3.223.26.213	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383203983 CET	1.1.1.1	192.168.2.5	0x13f2	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		34.228.147.189	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383203983 CET	1.1.1.1	192.168.2.5	0x13f2	No error (0)	ds-pr-bh.ybp.gysm.yahoodns.net		52.22.225.85	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:26.383513927 CET	1.1.1.1	192.168.2.5	0x9e47	No error (0)	pr-bh.ybp.yahoo.com	ds-pr-bh.ybp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		54.209.243.229	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		52.54.211.189	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		54.208.16.196	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		52.3.195.166	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		52.20.91.219	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		52.2.60.235	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		54.159.210.141	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192223072 CET	1.1.1.1	192.168.2.5	0xa448	No error (0)	cdn.w55c.net		54.175.232.95	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:28.192925930 CET	1.1.1.1	192.168.2.5	0x7d60	No error (0)	pm.w55c.net	cdn.w55c.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		54.157.70.26	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		54.161.249.158	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		52.71.152.188	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		52.2.41.65	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		52.207.103.73	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		54.152.50.166	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		54.164.224.122	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:29.655792952 CET	1.1.1.1	192.168.2.5	0x571c	No error (0)	sync.ipredictive.com		52.71.68.246	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:30.675941944 CET	1.1.1.1	192.168.2.5	0x5c1f	No error (0)	jelly.mdhv.io		216.239.34.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:30.675941944 CET	1.1.1.1	192.168.2.5	0x5c1f	No error (0)	jelly.mdhv.io		216.239.38.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:30.675941944 CET	1.1.1.1	192.168.2.5	0x5c1f	No error (0)	jelly.mdhv.io		216.239.32.21	A (IP address)	IN (0x0001)	false
Jan 16, 2024 00:17:30.675941944 CET	1.1.1.1	192.168.2.5	0x5c1f	No error (0)	jelly.mdhv.io		216.239.36.21	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	142.251.16.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:03 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:03 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-15 23:16:04 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-em4wzC08TdE5DdLIvP-rWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:04 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-15 23:16:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	142.251.163.101	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:06 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:06 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-t3iWFePgdgqA4QIaIms-Qw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:06 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6223 X-Daystart: 54966 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:06 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 32 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 34 39 36 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6223" elapsed_seconds="54966"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-01-15 23:16:06 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-01-15 23:16:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	104.21.35.148	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:06 UTC	680	OUT	GET /p/6797383828 HTTP/1.1 Host: booking.com-find-book.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:07 UTC	804	IN	HTTP/1.1 302 Found Date: Mon, 15 Jan 2024 23:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gblfb069mhaqajuu6ec5jcn3e6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: https://booking.com CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c6o%2BCq%2FRB9%2BeUYquok%2F%2FBWW4KGePXH3%2F3yEjWJ8CRvm7HxbTiA%2F5p0WXG11n74tN%2B8RM%2BGms11VpEvGCZEIabxx1JY%2BppIA66P5Ul3SOCqHLA2%2FV0ekx963IR6%2BiaB85Vxdks6YSccFqWsiz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8461d314ca9939b0-IAD alt-svc: h3=":443"; ma=86400
2024-01-15 23:16:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	13.249.39.5	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:07 UTC	654	OUT	GET / HTTP/1.1 Host: booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:08 UTC	912	IN	HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:08 GMT location: https://www.booking.com/ nel: {"report_to":"default","max_age":604800} report-to: {"group":"default","max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}]} strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c995a39c92e0058b&e=UmFuZG9tSVYkc2RlIyh9YdPFJGDFjZSqK4Z-4dNTMVvtDpeI69A5IA_iU2F5ktIrTbace0DrY1k x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: S_va2INO7xYZuNASZyzM3BCT5rS6UyQgb9GnFR9cups3NBX5XlqLag==
2024-01-15 23:16:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:08 UTC	658	OUT	GET / HTTP/1.1 Host: www.booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	2838	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:08 GMT vary: User-Agent, Accept-Encoding link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css>; rel=preload; as=style nel: {"max_age":604800,"report_to":"default"} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"} set-cookie: _implmdnbl=2__1__0; path=/; expires=Wed, 16-Jan-2019 23:16:08 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Wed, 30-Mar-2078 22:32:16 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:08 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block set-cookie: bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; Domain=.booking.com; Path=/; Expires=Wed, 14 Jan 2026 23:16:08 GMT; HttpOnly; Secure set-cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; Domain=.booking.com; Path=/; Expires=Tue, 14 Jan 2025 23:16:08 GMT; HttpOnly; Secure X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: XrSrwe7gvE4QMJ3kHATByGozKCA6xtEVdM4wWQ9M2lbAc_28rJcwBA==
2024-01-15 23:16:09 UTC	11926	IN	Data Raw: 32 65 38 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 56 63 30 76 6e 45 4d 42 32 34 35 59 66 43 65 22 Data Ascii: 2e8e<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="Vc0vnEMB245YfCe"
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 36 66 31 61 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 6f1a<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-01-15 23:16:09 UTC	12066	IN	Data Raw: 6e 74 68 7d 20 2d 20 7b 6d 6f 6e 74 68 5f 75 6e 74 69 6c 7d 2f 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 5f 75 6e 74 69 6c 7d 22 2c 22 6c 6f 6e 67 5f 64 61 74 65 5f 72 61 6e 67 65 5f 62 6f 74 68 5f 79 65 61 72 73 22 3a 22 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 20 e2 80 93 20 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 5f 75 6e 74 69 6c 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 5f 75 6e 74 69 6c 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 5f 75 6e 74 69 6c 7d 22 2c 22 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 5f 74 69 6d 65 5f 75 6e 74 69 6c 22 3a 22 7b 77 65 65 6b 64 61 79 7d 2c 20 7b 62 65 67 69 6e 5f 6d 61 72 6b 65 72 7d 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 Data Ascii: nth} - {month_until}/{day_of_month_until}","long_date_range_both_years":"{month_name} {day_of_month}, {full_year} {month_name_until} {day_of_month_until}, {full_year_until}","date_with_weekday_time_until":"{weekday}, {begin_marker}{month_name} {day_of
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 38 31 66 38 0d 0a 22 3a 22 53 61 74 75 72 64 61 79 22 2c 22 73 68 6f 72 74 22 3a 22 53 61 74 22 2c 22 73 68 6f 72 74 65 73 74 22 3a 22 53 61 22 2c 22 6e 61 6d 65 22 3a 22 53 61 74 75 72 64 61 79 22 2c 22 6e 61 6d 65 5f 6f 74 68 65 72 22 3a 22 53 61 74 75 72 64 61 79 22 2c 22 73 68 6f 72 74 5f 75 63 22 3a 22 53 61 74 22 2c 22 6e 61 6d 65 5f 66 72 6f 6d 5f 70 72 65 70 6f 73 69 74 69 6f 6e 22 3a 22 46 72 6f 6d 20 53 61 74 75 72 64 61 79 22 7d 2c 22 37 22 3a 7b 22 73 68 6f 72 74 65 73 74 22 3a 22 53 75 22 2c 22 6e 61 6d 65 22 3a 22 53 75 6e 64 61 79 22 2c 22 6e 61 6d 65 5f 6f 74 68 65 72 22 3a 22 53 75 6e 64 61 79 22 2c 22 6e 61 6d 65 5f 66 72 6f 6d 5f 70 72 65 70 6f 73 69 74 69 6f 6e 22 3a 22 46 72 6f 6d 20 53 75 6e 64 61 79 22 2c 22 73 68 6f 72 74 5f 75 63 Data Ascii: 81f8":"Saturday","short":"Sat","shortest":"Sa","name":"Saturday","name_other":"Saturday","short_uc":"Sat","name_from_preposition":"From Saturday"},"7":{"shortest":"Su","name":"Sunday","name_other":"Sunday","name_from_preposition":"From Sunday","short_uc
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 41 51 26 73 69 64 3d 30 30 35 39 32 34 32 64 34 62 61 66 62 65 37 35 39 32 31 30 64 34 65 61 33 65 61 35 38 32 63 62 26 73 74 69 64 3d 39 33 34 35 39 32 22 2c 0a 62 5f 69 73 5f 69 65 37 3a 20 22 22 2c 0a 62 5f 74 68 69 73 5f 75 72 6c 3a 20 22 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 77 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4b 34 2d 5a 61 74 42 73 41 43 41 64 49 43 4a 47 49 77 4e 7a 59 77 4e 6a 55 32 4c 54 63 7a 4f 54 49 74 4e 44 41 7a 59 79 30 35 4e 47 4a 6a 4c 54 6c 69 59 32 51 32 5a 44 49 35 4d 57 46 69 4e 74 67 43 42 65 41 43 41 51 26 73 69 64 3d 30 30 35 39 32 34 32 64 34 62 Data Ascii: AQ&sid=0059242d4bafbe759210d4ea3ea582cb&stid=934592",b_is_ie7: "",b_this_url: "/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=0059242d4b
2024-01-15 23:16:09 UTC	512	IN	Data Raw: 51 62 48 56 45 5a 59 65 4e 62 4e 45 49 49 59 49 45 62 46 65 62 41 57 65 22 3a 31 2c 22 4e 41 51 47 50 4c 65 4d 42 42 64 55 66 50 57 52 50 4a 56 53 59 5a 50 54 42 57 65 22 3a 31 2c 22 66 65 66 53 4b 65 45 52 43 65 59 61 43 46 64 43 44 57 4f 4f 43 22 3a 31 2c 22 65 57 66 62 57 4e 50 50 50 54 4a 45 50 46 57 46 51 63 64 58 55 43 22 3a 31 2c 22 64 4c 59 48 4d 52 46 65 52 51 4c 4f 4c 4f 4c 4f 64 51 55 56 52 4a 48 56 50 48 56 64 4e 48 52 4f 22 3a 31 2c 22 65 44 64 65 46 43 59 41 41 46 55 54 55 65 45 43 64 52 4a 4a 52 62 57 4e 48 55 44 53 43 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 53 42 48 41 54 59 4a 58 41 61 64 49 4a 4e 47 61 65 22 3a 31 2c 22 65 44 53 64 55 62 4b 48 52 4a 52 53 4d 44 49 57 4c 64 54 4e 50 42 4e 4f 63 58 52 42 5a 55 50 47 43 46 4a 56 48 57 45 4e Data Ascii: QbHVEZYeNbNEIIYIEbFebAWe":1,"NAQGPLeMBBdUfPWRPJVSYZPTBWe":1,"fefSKeERCeYaCFdCDWOOC":1,"eWfbWNPPPTJEPFWFQcdXUC":1,"dLYHMRFeRQLOLOLOdQUVRJHVPHVdNHRO":1,"eDdeFCYAAFUTUeECdRJJRbWNHUDSC":1,"HWAFNeOYSBHATYJXAadIJNGae":1,"eDSdUbKHRJRSMDIWLdTNPBNOcXRBZUPGCFJVHWEN
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 37 66 66 61 0d 0a 4d 58 4c 46 65 45 52 54 22 3a 31 2c 22 59 64 58 66 54 51 4e 64 65 41 57 4e 54 55 4d 4b 48 53 59 65 47 49 47 57 52 42 51 5a 58 52 54 22 3a 31 2c 22 48 57 41 46 59 59 4e 51 42 57 46 4b 65 22 3a 31 2c 22 47 64 4e 49 58 43 50 54 42 63 52 5a 64 62 58 64 55 4b 4c 61 44 57 56 63 4a 4e 5a 47 43 4f 65 46 4b 65 62 41 5a 4f 48 59 4f 22 3a 31 2c 22 4e 41 46 51 56 55 4e 4f 64 4f 4b 42 42 49 55 4a 4c 4d 46 65 66 50 5a 45 66 4b 46 57 57 66 61 47 4f 22 3a 31 2c 22 42 43 64 47 4e 52 41 5a 59 47 63 63 45 62 65 54 4c 61 41 46 5a 4b 41 55 64 52 58 4d 46 44 46 61 54 22 3a 31 2c 22 4e 41 46 51 43 4a 57 5a 55 62 52 53 64 55 46 51 62 4d 46 4b 4d 64 59 59 63 61 57 59 4f 61 56 43 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 46 57 55 46 4f 57 47 53 51 5a 64 57 4f 47 56 Data Ascii: 7ffaMXLFeERT":1,"YdXfTQNdeAWNTUMKHSYeGIGWRBQZXRT":1,"HWAFYYNQBWFKe":1,"GdNIXCPTBcRZdbXdUKLaDWVcJNZGCOeFKebAZOHYO":1,"NAFQVUNOdOKBBIUJLMFefPZEfKFWWfaGO":1,"BCdGNRAZYGccEbeTLaAFZKAUdRXMFDFaT":1,"NAFQCJWZUbRSdUFQbMFKMdYYcaWYOaVC":1,"HWAFNeOYFWUFOWGSQZdWOGV
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 65 64 4a 48 42 56 55 43 22 3a 31 2c 22 50 63 56 46 48 4d 50 61 52 52 65 61 53 64 49 65 5a 4e 4e 41 46 4c 57 45 5a 66 65 66 53 57 65 22 3a 31 2c 22 41 45 4a 50 45 43 56 56 44 57 43 50 42 66 49 48 53 48 46 54 41 63 45 54 22 3a 31 2c 22 49 5a 64 48 55 4e 46 53 55 43 4b 56 42 41 57 65 49 41 4c 65 55 49 4e 43 49 48 52 4a 44 4a 4f 22 3a 31 2c 22 42 43 64 47 4e 51 62 48 56 45 5a 59 65 4e 62 4e 45 49 49 59 49 45 62 46 52 46 65 51 45 48 54 22 3a 31 2c 22 41 45 41 46 50 49 50 42 63 64 43 43 57 4d 54 64 4b 66 58 4a 5a 4b 4e 46 62 66 42 41 43 22 3a 31 2c 22 4f 4f 49 42 54 42 42 4c 58 4f 4c 57 43 47 45 66 4a 63 66 4e 57 4f 43 65 4d 4a 59 47 49 57 65 22 3a 31 2c 22 4e 41 46 4c 53 44 64 63 66 65 4a 52 53 59 45 56 4a 44 66 64 46 63 61 65 22 3a 31 2c 22 48 4d 62 4b 41 63 Data Ascii: edJHBVUC":1,"PcVFHMPaRReaSdIeZNNAFLWEZfefSWe":1,"AEJPECVVDWCPBfIHSHFTAcET":1,"IZdHUNFSUCKVBAWeIALeUINCIHRJDJO":1,"BCdGNQbHVEZYeNbNEIIYIEbFRFeQEHT":1,"AEAFPIPBcdCCWMTdKfXJZKNFbfBAC":1,"OOIBTBBLXOLWCGEfJcfNWOCeMJYGIWe":1,"NAFLSDdcfeJRSYEVJDfdFcae":1,"HMbKAc
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 0d 0a 62 66 66 32 0d 0a 59 66 50 57 4d 50 64 4b 48 53 42 41 44 4b 61 66 4f 64 41 53 55 54 62 43 22 3a 31 2c 22 54 66 4e 5a 65 46 4f 42 4e 51 56 45 65 53 4e 64 52 54 22 3a 31 2c 22 49 5a 56 57 43 47 54 4c 44 45 5a 52 45 41 54 5a 64 53 47 57 55 43 22 3a 31 2c 22 4e 41 52 45 46 61 63 54 54 4e 41 49 42 61 46 4f 58 54 22 3a 31 2c 22 5a 64 5a 61 59 50 5a 5a 47 62 45 53 4d 51 4d 4c 65 66 4e 4f 53 54 55 50 49 43 53 53 53 58 64 48 46 45 4f 22 3a 33 2c 22 4e 41 52 45 46 63 4d 45 62 4a 4f 62 59 5a 66 66 51 4c 51 42 42 4f 22 3a 31 2c 22 41 42 56 59 55 59 4e 61 58 54 61 58 48 42 59 65 4e 54 44 56 58 4f 52 65 22 3a 31 2c 22 50 50 58 47 57 50 48 44 44 5a 4b 5a 64 4b 4e 4a 4d 4e 62 63 53 58 63 52 65 22 3a 31 2c 22 54 5a 55 66 64 62 59 66 54 51 55 4c 41 54 5a 64 53 47 57 Data Ascii: bff2YfPWMPdKHSBADKafOdASUTbC":1,"TfNZeFOBNQVEeSNdRT":1,"IZVWCGTLDEZREATZdSGWUC":1,"NAREFacTTNAIBaFOXT":1,"ZdZaYPZZGbESMQMLefNOSTUPICSSSXdHFEO":3,"NAREFcMEbJObYZffQLQBBO":1,"ABVYUYNaXTaXHBYeNTDVXORe":1,"PPXGWPHDDZKZdKNJMNbcSXcRe":1,"TZUfdbYfTQULATZdSGW
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 47 66 5a 4f 49 5a 49 56 53 45 51 55 45 51 45 52 5a 59 47 47 65 54 43 22 3a 32 2c 22 61 58 62 53 47 59 57 59 48 62 65 4e 50 49 41 52 54 59 54 22 3a 31 2c 22 61 61 4d 52 59 42 45 4e 4e 4c 5a 4f 65 64 5a 53 4e 4d 4f 42 66 43 22 3a 31 2c 22 50 50 58 47 53 43 5a 57 4e 54 50 46 65 5a 4b 55 49 4a 5a 54 4f 65 54 57 58 46 5a 45 56 43 22 3a 31 2c 22 42 43 64 47 4e 50 63 47 5a 66 64 65 51 63 55 59 53 59 48 4b 4a 45 57 41 51 48 46 42 41 56 50 66 43 22 3a 31 2c 22 5a 63 53 49 63 63 65 4e 4a 4e 62 64 4b 43 46 4b 56 57 58 41 54 52 65 22 3a 31 2c 22 62 51 62 59 57 58 46 5a 45 56 57 4b 4d 54 55 42 4e 41 44 50 46 45 66 62 4d 54 58 45 55 44 61 65 22 3a 32 2c 22 49 5a 56 47 50 52 46 66 45 46 4b 59 4f 65 65 4f 5a 62 4e 46 62 4b 48 44 48 54 22 3a 31 2c 22 48 57 41 46 4e 55 56 Data Ascii: GfZOIZIVSEQUEQERZYGGeTC":2,"aXbSGYWYHbeNPIARTYT":1,"aaMRYBENNLZOedZSNMOBfC":1,"PPXGSCZWNTPFeZKUIJZTOeTWXFZEVC":1,"BCdGNPcGZfdeQcUYSYHKJEWAQHFBAVPfC":1,"ZcSIcceNJNbdKCFKVWXATRe":1,"bQbYWXFZEVWKMTUBNADPFEfbMTXEUDae":2,"IZVGPRFfEFKYOeeOZbNFbKHDHT":1,"HWAFNUV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	23.221.45.212	443

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:08 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-15 23:16:09 UTC	495	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/250E) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=215029 Date: Mon, 15 Jan 2024 23:16:09 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	615	OUT	GET /static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 168278 Connection: close Server: nginx Date: Mon, 08 Jan 2024 06:22:29 GMT Last-Modified: Mon, 08 Jan 2024 02:44:50 GMT ETag: "659b61a2-29156" Expires: Wed, 07 Feb 2024 06:22:29 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: w4zAhPhW3DPMYlPGu-e3WcgHl6G6hlOi1sUG63wjV0yqo7rL6HF2WA== Age: 665620
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 62 2d 62 6f 6f 6b 65 72 2d 74 79 70 65 5f 5f 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 66 6f 72 6d 20 64 69 76 20 6c 61 62 65 6c 2e 62 2d 62 6f 6f 6b 65 72 2d 74 79 70 65 7b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 6c 61 62 65 6c 2d 62 75 73 69 6e 65 73 73 2d 74 72 69 70 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 30 70 78 20 33 70 78 20 33 70 78 20 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a Data Ascii: .b-booker-type__container{display:inline-block}form div label.b-booker-type{padding:0;font-weight:500}.label-business-trip{display:inline-block;margin-left:0;margin-right:5px;border-radius:20px 3px 3px 20px;padding:0 8px;line-height:24px;background-color:
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 63 68 2d 74 6f 6f 6c 74 69 70 2d 70 61 72 61 67 72 61 70 68 2e 70 61 72 61 67 72 61 70 68 2d 70 75 62 6c 69 63 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 73 69 64 65 62 61 72 2d 70 75 62 6c 69 63 2d 73 77 69 74 63 68 2d 74 6f 6f 6c 74 69 70 2e 69 73 2d 70 75 62 6c 69 63 20 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 73 69 64 65 62 61 72 2d 70 75 62 6c 69 63 2d 73 77 69 74 63 68 2d 74 6f 6f 6c 74 69 70 2d 70 61 72 61 67 72 61 70 68 2e 70 61 72 61 67 72 61 70 68 2d 70 72 69 76 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 70 75 62 6c 69 63 2d 74 69 6d 65 6c 69 6e 65 2d 74 6f 70 5f 5f 77 72 61 70 70 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 64 64 3b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 20 31 30 70 Data Ascii: ch-tooltip-paragraph.paragraph-public{display:none}.profile-area__sidebar-public-switch-tooltip.is-public .profile-area__sidebar-public-switch-tooltip-paragraph.paragraph-private{display:none}.public-timeline-top__wrapper{background:#ddd;margin:0 10px 10p
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 78 20 35 70 78 20 35 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 2e 61 63 63 6f 75 6e 74 5f 73 69 64 65 62 61 72 5f 6d 65 6e 75 20 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 7d 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 20 2e 68 65 61 64 65 72 5f 6c 6f 67 6f 75 74 5f 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: x 5px 5px;display:inline-block;font-size:12px}.account_sidebar_menu .user_center_option_nojs{padding-top:10px}.user_center_option_nojs a:hover{color:var(--bui_color_white)}.user_center_option_nojs .header_logout_link{color:var(--bui_color_white);font-size
2024-01-15 23:16:09 UTC	16331	IN	Data Raw: 3a 36 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 34 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 63 6f 6c 6f 72 3a 23 35 34 35 34 35 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 2a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 33 65 6d 7d 2e 69 6e 70 75 74 2d 62 6c 6f 63 6b 2d 6c 65 76 65 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 30 70 78 3b Data Ascii: :6px 10px;margin-bottom:10px;font-size:12px;line-height:14px;vertical-align:middle;color:#545454;background-color:var(--bui_color_white);border:1px solid #ccc;border-radius:3px;*margin-left:.3em}.input-block-level{display:block;width:100%;min-height:30px;
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 33 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 35 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 2d 68 65 61 64 65 72 2d 70 61 72 74 6e 65 72 73 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 62 61 64 34 66 37 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 2d 69 63 6f 6e 2d 73 76 67 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 68 65 69 67 68 74 3a 32 36 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 36 70 78 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 20 6c 69 20 61 3a 68 6f 76 65 72 20 2e 62 6b 2d 69 63 6f Data Ascii: 3ff;font-size:12px;padding:10px 5px;text-align:center}.profile-area__nav-header-partners{border-top:1px solid #bad4f7}.profile-area__nav-icon-svg{display:block;fill:var(--bui_color_white);height:26px;margin:0 auto 6px}.profile-area__nav li a:hover .bk-ico
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 29 20 69 6e 73 65 74 2c 30 20 31 70 78 20 32 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 20 69 6e 73 65 74 2c 30 20 31 70 78 20 32 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 20 23 69 61 6d 5f 69 66 72 61 6d 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 30 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 2d 70 61 64 64 69 6e 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 35 30 70 78 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 2d 6c 6f 61 64 65 72 7b 70 6f Data Ascii: ) inset,0 1px 20px rgba(0,0,0,0.4);box-shadow:0 0 2px rgba(0,0,0,0.4) inset,0 1px 20px rgba(0,0,0,0.4)}.user-access-form-iframe #iam_iframe{background:#fff;border:0}.user-access-form-iframe-padding{width:100%;height:50px}.user-access-form-iframe-loader{po
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 3a 31 65 6d 3b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 77 6c 5f 68 6f 74 65 6c 5f 69 74 65 6d 20 2e 68 6f 74 65 6c 5f 61 64 64 72 65 73 73 20 69 2e 69 63 6f 6e 2d 68 65 61 72 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 39 35 70 78 20 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 34 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 77 6c 5f 74 69 74 6c 65 20 2e 62 74 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 35 70 78 7d 2e 61 64 64 5f 68 6f 74 65 6c 5f 6e 6f 74 65 20 2e 69 6e 70 75 74 54 65 78 74 7b 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 Data Ascii: :1em;color:#999}.wl_hotel_item .hotel_address i.icon-heart{background-position:-95px 0;margin-right:4px;display:inline-block}#wl_title .btn{float:right;margin-left:10px;position:relative;top:5px}.add_hotel_note .inputText{width:320px;height:50px;border-ra
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 30 30 25 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 73 6f 63 69 61 6c 2d 63 6f 6e 6e 65 63 74 2d 62 75 74 74 6f 6e 73 2d 77 72 61 70 70 65 72 2d 2d 66 61 6c 6c 62 61 63 6b 20 2e 73 6f 63 69 61 6c 2d 63 6f 6e 6e 65 63 74 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 6f 63 69 61 6c 2d 63 6f 6e 6e 65 63 74 2d 62 75 74 74 6f 6e 2d Data Ascii: 00%;margin:10px 0 0;font-weight:bold}.social-connect-buttons-wrapper--fallback .social-connect-button{display:block;float:left;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;width:auto;max-width:100%}.social-connect-button-
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 64 61 6c 2d 6d 61 73 6b 5f 6f 76 65 72 7b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 34 7d 2e 66 65 65 64 62 61 63 6b 2d 6d 6f 64 61 6c 2d 77 72 61 70 70 65 72 5f 6f 76 65 72 7b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 35 7d 2e 6d 6f 64 61 6c 2d 77 72 61 70 70 65 72 2e 66 65 65 64 62 61 63 6b 2d 6d 6f 64 61 6c 2d 77 72 61 70 70 65 72 5f 6f 76 65 72 7b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 35 7d 2e 66 65 65 64 62 61 63 6b 2d 6c 6f 6f 70 2d 6c 69 67 68 74 62 6f 78 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 2e 66 65 65 64 62 61 Data Ascii: dal-mask_over{z-index:10004}.feedback-modal-wrapper_over{z-index:10005}.modal-wrapper.feedback-modal-wrapper_over{z-index:10005}.feedback-loop-lightbox{background:var(--bui_color_white);font-size:14px;line-height:1.4;display:none;margin:0;border:0}.feedba
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 61 6c 63 61 72 73 2d 6e 61 6d 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 65 22 7d 2e 62 69 63 6f 6e 2d 72 65 6e 74 61 6c 63 61 72 73 2d 64 6f 74 63 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 64 22 7d 2e 62 69 63 6f 6e 2d 74 72 65 6e 64 2d 64 6f 77 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 63 22 7d 2e 62 69 63 6f 6e 2d 74 72 65 6e 64 2d 64 6f 77 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 62 22 7d 2e 62 69 63 6f 6e 2d 68 69 6b 65 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 61 22 7d 2e 62 69 63 6f 6e 2d 6c 65 61 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 39 22 7d 2e 62 69 63 6f 6e 2d Data Ascii: alcars-name:before{content:"\b42e"}.bicon-rentalcars-dotcom:before{content:"\b42d"}.bicon-trend-down-right:before{content:"\b42c"}.bicon-trend-down-left:before{content:"\b42b"}.bicon-hikers:before{content:"\b42a"}.bicon-leaf:before{content:"\b429"}.bicon-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	614	OUT	GET /static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	793	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 7107 Connection: close Server: nginx Date: Tue, 02 Jan 2024 10:07:29 GMT Last-Modified: Fri, 28 Jul 2023 11:29:02 GMT ETag: "64c3a67e-1bc3" Expires: Thu, 01 Feb 2024 10:07:29 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: VYfglQYF-h1Hw9-XqquL3TFPCSLy1kgGKYFysuX3GnrowrbvaVpsGQ== Age: 1170520
2024-01-15 23:16:09 UTC	5134	IN	Data Raw: 2e 72 65 77 61 72 64 73 2d 69 6e 63 65 6e 74 69 70 70 79 7b 77 69 64 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 69 6e 63 65 6e 74 69 76 65 73 2f 69 6e 63 65 6e 74 69 70 70 79 2f 64 39 35 65 66 38 64 62 62 66 37 30 62 39 33 32 38 31 33 33 31 32 34 36 38 62 35 35 36 30 38 30 38 38 65 39 31 64 63 62 2e 73 76 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 35 30 25 20 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 34 70 78 20 32 34 70 78 7d 2e 72 65 77 61 72 64 73 2d 69 6e 63 65 6e 74 69 70 70 79 2d 67 72 61 79 7b 77 69 64 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f Data Ascii: .rewards-incentippy{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy/d95ef8dbbf70b932813312468b55608088e91dcb.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-gray{width:24px;height:24px;backgro
2024-01-15 23:16:09 UTC	1973	IN	Data Raw: 5f 5f 6d 6f 64 61 6c 20 2e 62 75 69 2d 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 70 6f 73 69 74 69 6f 6e 3a 69 6e 73 69 64 65 7d 23 72 65 77 61 72 64 73 2d 62 61 6e 6e 65 72 2d 6d 6f 64 61 6c 20 2e 62 75 69 2d 6d 6f 64 61 6c 5f 5f 70 61 72 61 67 72 61 70 68 2e 62 75 69 2d 74 65 78 74 2d 2d 76 61 72 69 61 6e 74 2d 73 6d 61 6c 6c 5f 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 Data Ascii: __modal .bui-list{padding-left:0!important;list-style-position:inside}#rewards-banner-modal .bui-modal__paragraph.bui-text--variant-small_1{font-size:var(--bui_font_small_1_font-size);font-weight:var(--bui_font_small_1_font-weight);line-height:var(--bui_f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49724	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	630	OUT	GET /static/js/core-deps-inlinedet_cloudfront_sd/65bb6e0c1caef9acc68156912864de9c2c826461.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 47458 Connection: close Server: nginx Date: Tue, 19 Dec 2023 08:58:19 GMT Last-Modified: Tue, 19 Dec 2023 07:29:30 GMT ETag: "6581465a-b962" Expires: Thu, 18 Jan 2024 08:58:19 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 0f954bea3b233fb0b6e1981b1e8b6bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Y2Pv3lQ9La-_-ZmD_RfM4leD--N0kc6a6diQYfG6fSpOd4DMqJYpGw== Age: 2384270
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 63 6f 72 65 5f 64 65 70 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 2f 2a 2a 0a 20 20 20 20 20 2a 20 40 6c 69 63 65 6e 73 65 20 61 6c 6d 6f 6e 64 20 30 2e 33 2e 30 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 31 2d 32 30 31 34 2c 20 54 68 65 20 44 6f 6a 6f 20 46 6f 75 6e 64 61 74 69 6f 6e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 20 20 20 20 20 2a 20 41 76 61 69 6c 61 62 6c 65 20 76 69 61 20 74 68 65 20 4d 49 54 20 6f 72 20 6e 65 77 20 42 53 44 20 6c 69 63 65 6e 73 65 Data Ascii: booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.core_deps={loaded:!0,run:!1}),function(){/** * @license almond 0.3.0 Copyright (c) 2011-2014, The Dojo Foundation All Rights Reserved. * Available via the MIT or new BSD license
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 6a 65 63 74 20 41 72 72 61 79 5d 22 3d 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 3b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 7d 3b 73 2e 6a 73 74 6d 70 6c 2e 73 65 74 75 70 28 7b 67 65 74 5f 73 74 61 74 69 63 5f 68 6f 73 74 6e 61 6d 65 3a 65 2c 67 65 74 5f 64 61 74 65 3a 6e 2c 67 65 74 5f 68 65 6c 70 65 72 3a 74 2c 66 6e 3a 7b 65 73 63 61 70 65 5f 68 74 6d 6c 3a 6f 2c 65 73 63 61 70 65 5f 65 6e 74 69 74 69 65 73 3a 61 2c 61 72 72 61 79 5f 6c 65 6e 67 74 68 3a 69 2c 69 6e 64 65 78 3a 72 2c 69 63 6f 6e 3a 66 2c 69 73 5f 72 6f 6f 6d 73 5f 74 61 62 6c 65 5f 73 70 6c 69 74 74 65 72 3a 6c 2c 66 6c 6f 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4d 61 Data Ascii: ject Array]"===Object.prototype.toString.call(e);return Array.isArray(e)};s.jstmpl.setup({get_static_hostname:e,get_date:n,get_helper:t,fn:{escape_html:o,escape_entities:a,array_length:i,index:r,icon:f,is_rooms_table_splitter:l,floor:function(e){return Ma
2024-01-15 23:16:09 UTC	12004	IN	Data Raw: 3d 5b 6f 28 65 29 2c 6e 2c 74 7c 7c 74 68 69 73 2c 72 5d 29 26 26 75 2e 70 75 73 68 28 69 29 2c 21 63 26 26 75 2e 6c 65 6e 67 74 68 26 26 28 73 2e 6f 6e 28 22 73 63 72 6f 6c 6c 22 2c 6c 29 2c 73 2e 6f 6e 28 22 72 65 73 69 7a 65 22 2c 6c 29 2c 63 3d 21 30 29 7d 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 77 68 65 6e 2f 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 65 28 22 70 72 6f 6d 69 73 65 22 29 2c 69 3d 65 28 22 6a 71 75 65 72 79 22 29 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 6e 61 6d 65 3a 22 63 6c 69 63 6b 22 2c 68 61 6e 64 6c 65 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 6e 29 2e 6f 6e 28 22 63 6c 69 Data Ascii: =[o(e),n,t\|\|this,r])&&u.push(i),!c&&u.length&&(s.on("scroll",l),s.on("resize",l),c=!0)}}),B.define("when/click",function(e,n,t){var r=e("promise"),i=e("jquery");t.exports={name:"click",handler:function(n){return new r(function(e){i(function(){i(n).on("cli
2024-01-15 23:16:09 UTC	2686	IN	Data Raw: 61 67 65 5f 76 69 65 77 5f 62 6f 6f 6b 22 2c 64 3d 22 69 6e 74 65 72 6e 61 6c 5f 70 61 67 65 5f 76 69 65 77 5f 63 68 65 63 6b 6f 75 74 5f 70 72 6f 70 5f 63 61 72 64 22 2c 61 3d 27 5b 64 61 74 61 2d 67 61 34 2d 74 72 61 63 6b 3d 22 63 68 61 6e 67 65 5f 73 65 6c 65 63 74 69 6f 6e 22 5d 27 2c 75 3d 27 5b 64 61 74 61 2d 67 61 34 2d 74 72 61 63 6b 3d 22 6e 65 77 73 6c 65 74 74 65 72 5f 73 69 67 6e 5f 75 70 22 5d 27 2c 73 3d 27 5b 64 61 74 61 2d 67 61 34 2d 74 72 61 63 6b 3d 22 61 70 70 5f 64 6f 77 6e 6c 6f 61 64 5f 68 65 61 64 65 72 22 5d 27 2c 70 3d 27 5b 64 61 74 61 2d 67 61 34 2d 74 72 61 63 6b 3d 22 61 70 70 5f 64 6f 77 6e 6c 6f 61 64 5f 66 6f 6f 74 65 72 22 5d 27 2c 68 3d 27 5b 64 61 74 61 2d 67 61 34 2d 74 72 61 63 6b 3d 22 6f 70 65 6e 5f 61 70 70 5f 68 Data Ascii: age_view_book",d="internal_page_view_checkout_prop_card",a='[data-ga4-track="change_selection"]',u='[data-ga4-track="newsletter_sign_up"]',s='[data-ga4-track="app_download_header"]',p='[data-ga4-track="app_download_footer"]',h='[data-ga4-track="open_app_h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49723	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	617	OUT	GET /static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 105026 Connection: close Server: nginx Date: Fri, 22 Dec 2023 09:50:39 GMT Last-Modified: Tue, 28 Jun 2022 13:43:41 GMT Expires: Sun, 21 Jan 2024 09:50:39 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "62bb058d-19a42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: sT7KDFyPRZ20DE7-qghtxNIORW-opcI6apAQU4fWvW8NO_sigziXgw== Age: 2121930
2024-01-15 23:16:09 UTC	15574	IN	Data Raw: 2f 2a 20 40 70 72 65 73 65 72 76 65 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 31 31 2e 33 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e Data Ascii: /* @preserve * jQuery JavaScript Library v1.11.3 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright 2005, 2014 jQuery Foundation, Inc. and other contributors * Released under the MIT license * http://jquery.org/licen
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 21 79 3b 69 66 28 63 29 7b 69 66 28 6d 29 7b 66 6f 72 28 3b 6c 3b 29 7b 66 6f 72 28 6f 3d 65 3b 6f 3d 6f 5b 6c 5d 3b 29 69 66 28 79 3f 6f 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 6f 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 70 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 76 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 76 26 26 64 29 7b 66 6f 72 28 73 3d 28 72 3d 28 69 3d 63 5b 4e 5d 7c 7c 28 63 5b 4e 5d 3d 7b 7d 29 29 5b 70 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 2c 61 3d 72 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 32 5d 2c 6f 3d 73 26 26 63 2e Data Ascii: !y;if(c){if(m){for(;l;){for(o=e;o=o[l];)if(y?o.nodeName.toLowerCase()===f:1===o.nodeType)return!1;u=l="only"===p&&!u&&"nextSibling"}return!0}if(u=[v?c.firstChild:c.lastChild],v&&d){for(s=(r=(i=c[N]\|\|(c[N]={}))[p]\|\|[])[0]===k&&r[1],a=r[0]===k&&r[2],o=s&&c.
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 65 45 78 70 61 6e 64 6f 3d 21 31 7d 7d 65 3d 6e 75 6c 6c 7d 28 29 2c 43 2e 61 63 63 65 70 74 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 43 2e 6e 6f 44 61 74 61 5b 28 65 2e 6e 6f 64 65 4e 61 6d 65 2b 22 20 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 2c 6e 3d 2b 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 3b 72 65 74 75 72 6e 28 31 3d 3d 3d 6e 7c 7c 39 3d 3d 3d 6e 29 26 26 28 21 74 7c 7c 21 30 21 3d 3d 74 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 69 64 22 29 3d 3d 3d 74 29 7d 3b 76 61 72 20 4f 3d 2f 5e 28 3f 3a 5c 7b 5b 5c 77 5c 57 5d 2a 5c 7d 7c 5c 5b 5b 5c 77 5c 57 5d 2a 5c 5d 29 24 2f 2c 46 3d 2f 28 5b 41 2d 5a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 42 28 65 2c 74 2c 6e 29 7b 69 66 28 76 6f 69 64 Data Ascii: eExpando=!1}}e=null}(),C.acceptData=function(e){var t=C.noData[(e.nodeName+" ").toLowerCase()],n=+e.nodeType\|\|1;return(1===n\|\|9===n)&&(!t\|\|!0!==t&&e.getAttribute("classid")===t)};var O=/^(?:\{[\w\W]\}\|\[[\w\W]\])$/,F=/([A-Z])/g;function B(e,t,n){if(void
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 30 29 7d 7d 29 3b 76 61 72 20 6e 65 3d 22 61 62 62 72 7c 61 72 74 69 63 6c 65 7c 61 73 69 64 65 7c 61 75 64 69 6f 7c 62 64 69 7c 63 61 6e 76 61 73 7c 64 61 74 61 7c 64 61 74 61 6c 69 73 74 7c 64 65 74 61 69 6c 73 7c 66 69 67 63 61 70 74 69 6f 6e 7c 66 69 67 75 72 65 7c 66 6f 6f 74 65 72 7c 68 65 61 64 65 72 7c 68 67 72 6f 75 70 7c 6d 61 72 6b 7c 6d 65 74 65 72 7c 6e 61 76 7c 6f 75 74 70 75 74 7c 70 72 6f 67 72 65 73 73 7c 73 65 63 74 69 6f 6e 7c 73 75 6d 6d 61 72 79 7c 74 69 6d 65 7c 76 69 64 65 6f 22 2c 72 65 3d 2f 20 6a 51 75 65 72 79 5c 64 2b 3d 22 28 3f 3a 6e 75 6c 6c 7c 5c 64 2b 29 22 2f 67 2c 69 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3c 28 3f 3a 22 2b 6e 65 2b 22 29 5b 5c 5c 73 2f 3e 5d 22 2c 22 69 22 29 2c 6f 65 3d 2f 5e 5c 73 2b 2f 2c 61 65 3d Data Ascii: 0)}});var ne="abbr\|article\|aside\|audio\|bdi\|canvas\|data\|datalist\|details\|figcaption\|figure\|footer\|header\|hgroup\|mark\|meter\|nav\|output\|progress\|section\|summary\|time\|video",re=/ jQuery\d+="(?:null\|\d+)"/g,ie=new RegExp("<(?:"+ne+")[\\s/>]","i"),oe=/^\s+/,ae=
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 3d 74 68 69 73 2e 6e 6f 77 3d 74 68 69 73 2e 63 75 72 28 29 2c 74 68 69 73 2e 65 6e 64 3d 72 2c 74 68 69 73 2e 75 6e 69 74 3d 6f 7c 7c 28 43 2e 63 73 73 4e 75 6d 62 65 72 5b 6e 5d 3f 22 22 3a 22 70 78 22 29 7d 2c 63 75 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 4a 65 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 67 65 74 3f 65 2e 67 65 74 28 74 68 69 73 29 3a 4a 65 2e 70 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 67 65 74 28 74 68 69 73 29 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 4a 65 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 3f 74 Data Ascii: =this.now=this.cur(),this.end=r,this.unit=o\|\|(C.cssNumber[n]?"":"px")},cur:function(){var e=Je.propHooks[this.prop];return e&&e.get?e.get(this):Je.propHooks._default.get(this)},run:function(e){var t,n=Je.propHooks[this.prop];return this.options.duration?t
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 26 5d 2a 2f 2c 6a 74 3d 2f 5e 28 2e 2a 3f 29 3a 5b 20 5c 74 5d 2a 28 5b 5e 5c 72 5c 6e 5d 2a 29 5c 72 3f 24 2f 67 6d 2c 41 74 3d 2f 5e 28 3f 3a 47 45 54 7c 48 45 41 44 29 24 2f 2c 44 74 3d 2f 5e 5c 2f 5c 2f 2f 2c 4c 74 3d 2f 5e 28 5b 5c 77 2e 2b 2d 5d 2b 3a 29 28 3f 3a 5c 2f 5c 2f 28 3f 3a 5b 5e 5c 2f 3f 23 5d 2a 40 7c 29 28 5b 5e 5c 2f 3f 23 3a 5d 2a 29 28 3f 3a 3a 28 5c 64 2b 29 7c 29 7c 29 2f 2c 48 74 3d 7b 7d 2c 5f 74 3d 7b 7d 2c 71 74 3d 22 2a 2f 22 2e 63 6f 6e 63 61 74 28 22 2a 22 29 3b 74 72 79 7b 45 74 3d 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7d 63 61 74 63 68 28 65 29 7b 28 45 74 3d 4e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 29 2e 68 72 65 66 3d 22 22 2c 45 74 3d 45 74 2e 68 72 65 66 7d 66 75 6e 63 74 69 6f 6e 20 4d 74 28 6f 29 Data Ascii: &]/,jt=/^(.?):[ \t]([^\r\n])\r?$/gm,At=/^(?:GET\|HEAD)$/,Dt=/^\/\//,Lt=/^([\w.+-]+:)(?:\/\/(?:[^\/?#]@\|)([^\/?#:])(?::(\d+)\|)\|)/,Ht={},_t={},qt="/".concat("");try{Et=location.href}catch(e){(Et=N.createElement("a")).href="",Et=Et.href}function Mt(o)
2024-01-15 23:16:09 UTC	7532	IN	Data Raw: 26 26 6c 2e 61 74 74 72 48 6f 6f 6b 73 2e 76 61 6c 75 65 2e 67 65 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 2c 6f 3d 6c 2e 61 74 74 72 48 6f 6f 6b 73 2e 76 61 6c 75 65 26 26 6c 2e 61 74 74 72 48 6f 6f 6b 73 2e 76 61 6c 75 65 2e 73 65 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 66 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 64 3d 2f 5e 5b 32 33 38 5d 24 2f 2c 70 3d 2f 5e 28 3f 3a 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 61 73 79 6e 63 7c 63 68 65 63 6b 65 64 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 Data Ascii: &&l.attrHooks.value.get\|\|function(){return null},o=l.attrHooks.value&&l.attrHooks.value.set\|\|function(){return a},f=/^(?:input\|button)$/i,d=/^[238]$/,p=/^(?:autofocus\|autoplay\|async\|checked\|controls\|defer\|disabled\|hidden\|loop\|multiple\|open\|readonly\|requir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49728	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	615	OUT	GET /static/js/main_cloudfront_sd/d28523665f62421e5c65b8c6fc6848b561f4e4a2.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 583161 Connection: close Server: nginx Date: Fri, 05 Jan 2024 06:31:45 GMT Last-Modified: Fri, 05 Jan 2024 06:00:00 GMT ETag: "65979ae0-8e5f9" Expires: Sun, 04 Feb 2024 06:31:45 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 dc81af6f14945ade0fd126a735f82ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: GqruRLI15UUd2oPckHHPE2GENf6CNckUBlIVdYbQ17d6Hwyad7n_6Q== Age: 924263
2024-01-15 23:16:09 UTC	15575	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 61 6c 63 61 67 65 28 65 2c 74 2c 69 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 66 38 37 38 34 30 31 34 22 29 2c 73 3d 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 74 29 25 69 29 2e 74 6f 53 74 72 69 6e 67 28 29 2c 4c 65 61 64 69 6e 67 5a 65 72 6f 26 26 73 2e 6c 65 6e 67 74 68 3c 32 26 26 28 73 3d 22 30 22 2b 73 29 2c 5f 72 5f 28 22 3c 62 3e 22 2b 73 2b 22 3c 2f 62 3e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 43 6f 75 6e 74 42 61 63 6b 28 65 29 7b 69 66 28 5f 69 5f 28 22 33 64 61 3a 37 33 32 63 32 33 35 36 22 29 2c 65 3c 30 29 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function calcage(e,t,i){return _i_("3da:f8784014"),s=(Math.floor(e/t)%i).toString(),LeadingZero&&s.length<2&&(s="0"+s),_r_("<b>"+s+"</b>")}function CountBack(e){if(_i_("3da:732c2356"),e<0)
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 41 64 64 46 61 76 6f 72 69 74 65 28 74 2c 65 29 3a 61 6c 65 72 74 28 22 53 6f 72 72 79 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 74 68 69 73 20 66 75 6e 63 74 69 6f 6e 5c 6e 54 6f 20 62 6f 6f 6b 6d 61 72 6b 20 74 68 69 73 20 70 61 67 65 5c 6e 57 69 6e 64 6f 77 73 20 75 73 65 72 73 20 70 72 65 73 73 20 63 74 72 6c 20 2b 20 44 5c 6e 4d 61 63 20 75 73 65 72 73 20 70 72 65 73 73 20 63 6d 64 20 2b 20 44 22 29 2c 5f 72 5f 28 29 7d 2c 77 69 6e 64 6f 77 2e 68 69 64 65 46 72 61 6d 65 43 6f 6e 74 61 69 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 5f 69 5f 28 22 33 64 61 3a 35 65 36 65 36 31 65 62 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: window.external.AddFavorite(t,e):alert("Sorry your browser doesn't support this function\nTo bookmark this page\nWindows users press ctrl + D\nMac users press cmd + D"),_r_()},window.hideFrameContainer=function(e){(_i_("3da:5e6e61eb"),document.getElementB
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 7b 65 76 65 6e 74 73 3a 65 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 66 37 33 62 39 34 30 34 22 29 2c 74 68 69 73 2e 66 72 61 67 6d 65 6e 74 4c 6f 61 64 46 72 61 67 6d 65 6e 74 28 29 2c 5f 72 5f 28 29 7d 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 5f 72 5f 28 29 7d 2c 66 72 61 67 6d 65 6e 74 50 61 72 61 6d 41 74 74 72 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 35 32 65 33 34 39 62 31 22 29 3b 66 6f 72 28 76 61 72 20 65 2c 74 2c 69 3d 7b 7d 2c 6e 3d 74 68 69 73 2e 65 6c 2e 61 74 74 72 69 62 75 74 65 73 2c 72 3d 30 2c 61 3d 6e 2e 6c 65 6e 67 74 68 3b 72 3c 61 3b 72 2b 2b 29 28 74 3d 28 65 3d 6e 5b 72 5d 29 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 35 3c 74 2e 6c 65 6e 67 74 68 26 26 30 3d 3d 3d 74 2e 69 6e Data Ascii: {events:e}).run(function(){_i_("3da:f73b9404"),this.fragmentLoadFragment(),_r_()}.bind(this)),_r_()},fragmentParamAttrs:function(){_i_("3da:52e349b1");for(var e,t,i={},n=this.el.attributes,r=0,a=n.length;r<a;r++)(t=(e=n[r]).nodeName)&&5<t.length&&0===t.in
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 68 2e 66 6c 6f 6f 72 28 33 30 2e 36 30 30 31 2a 75 29 2c 69 3d 75 2d 31 2c 31 33 3c 75 26 26 28 63 2b 3d 31 2c 69 3d 75 2d 31 33 29 2c 6e 3d 63 2d 34 37 31 36 3b 76 61 72 20 66 3d 73 2d 31 39 34 38 30 38 34 2c 68 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 66 2f 31 30 36 33 31 29 3b 66 2d 3d 31 30 36 33 31 2a 68 3b 76 61 72 20 70 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 66 2d 2e 31 33 33 35 29 2f 28 31 30 36 33 31 2f 33 30 29 29 2c 6d 3d 33 30 2a 68 2b 70 3b 66 2d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 70 2a 28 31 30 36 33 31 2f 33 30 29 2b 2e 31 33 33 35 29 3b 76 61 72 20 76 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 66 2b 32 38 2e 35 30 30 31 29 2f 32 39 2e 35 29 3b 31 33 3d 3d 76 26 26 28 76 3d 31 32 29 3b 76 61 72 20 62 3d 66 2d 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 39 Data Ascii: h.floor(30.6001u),i=u-1,13<u&&(c+=1,i=u-13),n=c-4716;var f=s-1948084,h=Math.floor(f/10631);f-=10631h;var p=Math.floor((f-.1335)/(10631/30)),m=30h+p;f-=Math.floor(p(10631/30)+.1335);var v=Math.floor((f+28.5001)/29.5);13==v&&(v=12);var b=f-Math.floor(29
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 6f 66 66 28 22 6d 6f 75 73 65 6c 65 61 76 65 22 29 2e 6d 6f 75 73 65 6c 65 61 76 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 65 61 66 35 39 32 36 38 22 29 2c 65 2e 5f 68 69 64 65 54 69 6d 65 6f 75 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 38 65 37 33 63 63 30 66 22 29 2c 65 2e 68 69 64 65 28 29 2c 5f 72 5f 28 29 7d 2c 65 2e 6f 70 74 69 6f 6e 73 2e 68 69 64 65 44 65 6c 61 79 29 2c 5f 72 5f 28 29 7d 29 29 2c 5f 72 5f 28 29 7d 2c 6f 6e 6d 6f 75 73 65 6c 65 61 76 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 32 35 65 38 30 37 34 64 22 29 3b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 73 68 6f 77 54 69 6d 65 6f 75 74 26 26 28 63 6c 65 61 72 54 69 6d 65 Data Ascii: .off("mouseleave").mouseleave(function(){_i_("3da:eaf59268"),e._hideTimeout=setTimeout(function(){_i_("3da:8e73cc0f"),e.hide(),_r_()},e.options.hideDelay),_r_()})),_r_()},onmouseleave:function(){_i_("3da:25e8074d");var e=this;this._showTimeout&&(clearTime
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 3d 41 72 72 61 79 28 65 29 2c 74 3d 30 3b 74 3c 65 3b 74 2b 2b 29 73 5b 74 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 72 65 74 75 72 6e 20 5f 72 5f 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 30 36 30 35 35 33 34 39 22 29 2c 5f 72 5f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 5f 69 5f 28 22 33 64 61 3a 65 35 36 31 66 62 30 33 22 29 3b 76 61 72 20 6e 3d 5f 28 65 2c 74 2c 69 29 2c 72 3d 6e 2e 64 69 73 70 61 74 63 68 2c 61 3d 5b 5d 2c 6f 3d 7b 67 65 74 53 74 61 74 65 3a 6e 2e 67 65 74 53 74 61 74 65 2c 64 69 73 70 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 30 66 65 35 34 31 31 62 22 29 2c 5f 72 5f 28 72 28 65 29 29 7d 7d 3b 72 65 74 75 72 6e 20 61 3d Data Ascii: =Array(e),t=0;t<e;t++)s[t]=arguments[t];return _r_(function(_){return _i_("3da:06055349"),_r_(function(e,t,i){_i_("3da:e561fb03");var n=_(e,t,i),r=n.dispatch,a=[],o={getState:n.getState,dispatch:function(e){return _i_("3da:0fe5411b"),_r_(r(e))}};return a=
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 29 2c 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 29 7d 2c 5f 72 5f 28 29 7d 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 6c 6f 61 64 22 2c 63 6f 6e 64 69 74 69 6f 6e 3a 42 2e 65 6e 76 2e 66 65 5f 63 6f 6f 6b 69 65 5f 77 61 72 6e 69 6e 67 26 26 42 2e 65 6e 76 2e 62 5f 62 6f 6f 6b 69 6e 67 73 5f 6f 77 6e 65 64 26 26 42 2e 65 6e 76 2e 66 65 5f 63 6f 6f 6b 69 65 5f 64 65 74 65 63 74 6f 72 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 5f 69 5f 28 22 33 64 61 3a 30 37 63 33 65 62 38 33 22 29 2c 21 42 2e 65 76 65 6e 74 45 6d 69 74 74 65 72 7c 7c 21 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f Data Ascii: ),_r_()}),_r_()})},_r_()}),B.when({events:"load",condition:B.env.fe_cookie_warning&&B.env.b_bookings_owned&&B.env.fe_cookie_detector}).run(function(e){if(_i_("3da:07c3eb83"),!B.eventEmitter\|\|!window.navigator\|\|"function"!=typeof window.navigator.sendBeaco
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 63 73 73 28 22 62 6f 72 64 65 72 22 2b 69 2b 22 57 69 64 74 68 22 29 2c 31 30 29 7c 7c 30 29 2c 66 5b 72 5d 2b 3d 68 5b 6e 5d 7c 7c 30 2c 70 2e 6f 76 65 72 5b 6e 5d 26 26 28 66 5b 72 5d 2b 3d 75 5b 22 78 22 3d 3d 3d 74 3f 22 77 69 64 74 68 22 3a 22 68 65 69 67 68 74 22 5d 28 29 2a 70 2e 6f 76 65 72 5b 6e 5d 29 29 3a 28 69 3d 75 5b 6e 5d 2c 66 5b 72 5d 3d 69 2e 73 6c 69 63 65 26 26 22 25 22 3d 3d 3d 69 2e 73 6c 69 63 65 28 2d 31 29 3f 70 61 72 73 65 46 6c 6f 61 74 28 69 29 2f 31 30 30 2a 6f 3a 69 29 2c 70 2e 6c 69 6d 69 74 26 26 2f 5e 5c 64 2b 24 2f 2e 74 65 73 74 28 66 5b 72 5d 29 26 26 28 66 5b 72 5d 3d 66 5b 72 5d 3c 3d 30 3f 30 3a 4d 61 74 68 2e 6d 69 6e 28 66 5b 72 5d 2c 6f 29 29 2c 21 65 26 26 31 3c 70 2e 61 78 69 73 2e 6c 65 6e 67 74 68 26 26 28 Data Ascii: .css("border"+i+"Width"),10)\|\|0),f[r]+=h[n]\|\|0,p.over[n]&&(f[r]+=u["x"===t?"width":"height"]()p.over[n])):(i=u[n],f[r]=i.slice&&"%"===i.slice(-1)?parseFloat(i)/100o:i),p.limit&&/^\d+$/.test(f[r])&&(f[r]=f[r]<=0?0:Math.min(f[r],o)),!e&&1<p.axis.length&&(
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 5d 2c 74 29 3b 65 6c 73 65 20 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 7b 76 61 72 20 69 3d 7b 7d 3b 74 28 69 29 2c 65 2e 67 6f 6f 67 6c 65 4f 6e 65 54 61 70 3d 69 7d 5f 72 5f 28 29 7d 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 74 68 69 73 3a 73 65 6c 66 3a 67 6c 6f 62 61 6c 54 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 36 30 31 Data Ascii: e.amd)define(["exports"],t);else if("undefined"!=typeof exports)t(exports);else{var i={};t(i),e.googleOneTap=i}_r_()}("undefined"==typeof globalThis?"undefined"==typeof self?this:self:globalThis,function(e){"use strict";function u(e,t){return _i_("3da:601
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 74 28 42 2e 68 6f 74 65 6c 2e 45 76 65 6e 74 73 2e 52 54 2e 53 54 49 43 4b 59 5f 52 45 4c 45 41 53 45 2c 61 29 2c 5f 72 5f 28 29 7d 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 39 66 31 63 31 37 63 66 22 29 2c 2d 31 3d 3d 3d 78 2e 62 6f 6f 6b 69 6e 67 53 74 69 63 6b 65 72 2e 73 74 69 63 6b 65 64 45 6c 65 6d 65 6e 74 73 2e 69 6e 64 65 78 4f 66 28 61 29 26 26 28 78 2e 62 6f 6f 6b 69 6e 67 53 74 69 63 6b 65 72 2e 73 74 69 63 6b 65 64 45 6c 65 6d 65 6e 74 73 2e 70 75 73 68 28 61 29 2c 79 28 29 29 2c 5f 72 5f 28 29 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 66 34 61 38 65 31 35 34 22 29 3b 76 61 72 20 65 3d 78 2e 62 6f 6f 6b 69 6e 67 53 74 69 63 6b 65 72 2e 73 74 69 63 6b 65 64 45 6c 65 6d 65 6e 74 73 2e 69 Data Ascii: t(B.hotel.Events.RT.STICKY_RELEASE,a),_r_()},b=function(){_i_("3da:9f1c17cf"),-1===x.bookingSticker.stickedElements.indexOf(a)&&(x.bookingSticker.stickedElements.push(a),y()),_r_()},g=function(){_i_("3da:f4a8e154");var e=x.bookingSticker.stickedElements.i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49720	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	609	OUT	GET /static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 350175 Connection: close Server: nginx Date: Tue, 02 Jan 2024 15:56:36 GMT Last-Modified: Fri, 15 Dec 2023 12:28:35 GMT ETag: "657c4673-557df" Expires: Thu, 01 Feb 2024 15:56:36 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: zEcelN-IlWq1RRozwHms_DUPlk3KZWS_lluSw061OHStSsjhTeMnQw== Age: 1149573
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 75 6c 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 6c 69 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 6c 69 6e 6b 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 76 69 73 69 74 65 64 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 68 6f 76 65 72 2c 2e 64 65 73 74 69 6e 61 74 Data Ascii: .destination-suggestion ul,.destination-suggestion li{margin:0;padding:0;border:0;vertical-align:baseline}.destination-suggestion ul{list-style:none}.destination-suggestion a:link,.destination-suggestion a:visited,.destination-suggestion a:hover,.destinat
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2d 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 74 61 62 6c 65 20 74 72 20 74 64 20 2e 63 6f 75 6e 74 72 79 6c 69 6e 6b 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 23 74 6f 70 2d 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 74 61 62 6c 65 20 74 72 20 74 64 20 2e 68 6f 74 65 6c 63 6f 75 6e 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 39 32 65 6d 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 70 78 7d 23 74 6f 70 2d 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 74 61 62 6c 65 20 74 72 20 74 64 20 2e 6c 61 73 74 62 6f 6f 6b 69 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d Data Ascii: -destinations table tr td .countrylink{font-weight:normal;text-decoration:none}#top-destinations table tr td .hotelcount{font-weight:normal;font-size:.92em;color:#666;display:block;margin-top:3px}#top-destinations table tr td .lastbooking{font-weight:norm
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 64 65 73 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 32 30 70 78 7d 2e 66 65 61 74 75 72 65 64 5f 64 65 73 74 20 68 32 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 7d 2e 66 65 61 74 75 72 65 64 5f 64 65 73 74 5f 69 74 65 6d 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 35 30 25 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2d 31 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 35 70 78 7d 2e 66 65 61 74 75 72 65 64 5f 64 65 73 74 5f 69 74 65 6d 5f 69 6e 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 33 38 70 78 7d 2e 66 65 61 74 75 72 65 64 5f 64 65 73 74 5f 6e 61 6d 65 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 7d 2e Data Ascii: dest{margin-left:-20px}.featured_dest h2{margin-left:20px}.featured_dest_item{float:left;width:50%;margin-right:-1px;padding-bottom:35px}.featured_dest_item_inner{position:relative;margin-left:20px;padding-top:138px}.featured_dest_name a{font-size:1.2em}.
2024-01-15 23:16:09 UTC	15082	IN	Data Raw: 69 63 6f 6e 2d 2d 32 31 34 30 34 37 39 2f 38 62 37 30 63 30 33 32 38 30 30 65 63 37 34 65 37 38 30 37 65 37 38 63 34 32 66 34 31 35 63 64 61 33 39 34 32 38 35 34 2e 70 6e 67 29 7d 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 2d 2d 69 63 6f 6e 2e 69 63 6f 6e 2d 2d 33 34 31 34 34 34 30 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 65 78 70 6c 6f 72 65 72 2f 75 66 69 5f 69 63 6f 6e 73 2f 69 63 6f 6e 2d 2d 33 34 31 34 34 34 30 2f 32 33 33 37 63 33 64 38 32 36 32 38 34 30 36 61 39 35 62 63 32 66 65 34 64 63 66 37 30 39 38 66 39 36 65 31 65 61 37 32 2e 70 6e 67 29 7d 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 Data Ascii: icon--2140479/8b70c032800ec74e7807e78c42f415cda3942854.png)}.guides_index_entry_point--icon.icon--3414440{background-image:url(//cf.bstatic.com/static/img/explorer/ufi_icons/icon--3414440/2337c3d82628406a95bc2fe4dcf7098f96e1ea72.png)}.guides_index_entry_p
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 63 74 61 5f 62 75 74 74 6f 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 37 31 63 32 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 62 6f 72 64 65 72 3a 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 70 61 64 64 69 6e 67 3a 2e 38 65 6d 20 31 65 6d 3b 77 69 64 74 68 3a 33 35 25 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 6c 61 62 65 6c 2e 72 65 76 69 65 77 5f 63 74 61 5f 6c 61 62 65 6c 5f 72 74 6c 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 68 65 69 67 68 74 3a 61 75 Data Ascii: cta_button{float:right;text-align:center;background:#0071c2;height:auto;border:0;color:var(--bui_color_white);border-radius:4px;padding:.8em 1em;width:35%;line-height:1.4;cursor:pointer;text-decoration:none}label.review_cta_label_rtl{float:right;height:au
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 64 5f 5f 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 7d 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 5f 5f 6e 65 77 2d 69 64 65 6e 74 69 74 79 20 2e 62 75 69 2d 6c 69 73 74 2e 68 6f 72 69 7a 6f 6e 74 61 6c 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d Data Ascii: d__content{margin-right:8px}.genius-levels-status.genius-levels-status__new-identity .bui-list.horizontal{-webkit-box-align:start;-webkit-align-items:flex-start;-ms-flex-align:start;align-items:flex-start;display:-webkit-box;display:-webkit-flex;display:-
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 72 6c 70 2d 73 69 64 65 62 61 72 2d 6e 61 76 2d 62 74 6e 5f 5f 63 6f 75 6e 74 72 79 2d 6e 61 6d 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 32 30 70 78 20 32 30 70 78 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 31 70 78 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 72 6c 70 2d 73 69 64 65 62 61 72 2d 6e 61 76 2d 62 74 6e 5f 5f 63 6f 75 6e 74 72 79 2d 6e 61 6d 65 2e 72 6c 70 2d 73 Data Ascii: width:100%;height:100%}.rlp-sidebar-nav-btn__country-name{display:block;height:100%;padding:20px 20px 0;font-size:16px;line-height:21px;text-decoration:none;text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.rlp-sidebar-nav-btn__country-name.rlp-s
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 30 30 25 20 38 30 25 7d 2e 70 61 73 73 69 6f 6e 2d 62 61 6e 6e 65 72 2d 2d 68 61 6b 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 67 72 6f 77 74 68 2d 6d 61 72 6b 65 74 69 6e 67 2f 70 61 73 73 69 6f 6e 2d 73 65 61 72 63 68 2f 62 61 6e 6e 65 72 2d 68 61 6b 61 2f 33 64 30 32 37 35 36 64 65 64 66 35 33 65 34 32 32 65 31 39 63 33 35 37 34 30 61 30 35 32 32 39 36 37 35 36 31 62 35 30 2e 6a 70 67 27 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 7d 2e 70 61 73 73 69 6f 6e 2d 62 61 6e 6e 65 72 5f 5f 61 73 2d 73 65 65 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 Data Ascii: d-position:100% 80%}.passion-banner--haka{background-image:url('//cf.bstatic.com/static/img/growth-marketing/passion-search/banner-haka/3d02756dedf53e422e19c35740a0522967561b50.jpg');background-size:cover}.passion-banner__as-seen{font-size:11px;line-heigh
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 62 70 67 5f 6c 6f 67 6f 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 6c 70 2d 75 73 70 5f 5f 63 6f 6e 74 65 6e 74 20 64 69 76 23 72 61 74 65 5f 67 75 61 72 61 6e 74 65 65 20 61 2c 2e 6c 70 2d 75 73 70 5f 5f 63 6f 6e 74 65 6e 74 20 64 69 76 23 72 61 74 65 5f 67 75 61 72 61 6e 74 65 65 20 61 3a 76 69 73 69 74 65 64 2c 2e 6c 70 2d 75 73 70 5f 5f 63 6f 6e 74 65 6e 74 20 64 69 76 23 72 61 74 65 5f 67 75 61 72 61 6e 74 65 65 20 61 3a 68 6f 76 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 23 30 30 37 31 63 32 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 6c Data Ascii: .bpg_logo{display:none}.lp-usp__content div#rate_guarantee a,.lp-usp__content div#rate_guarantee a:visited,.lp-usp__content div#rate_guarantee a:hover{font-size:15px;font-style:normal;font-weight:normal;color:#0071c2!important;text-decoration:underline}.l
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2d 68 65 61 64 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 65 6e 74 72 79 2d 75 70 63 6f 6d 69 6e 67 2d 62 6f 6f 6b 69 6e 67 2d 63 61 72 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 7d 2e 65 6e 74 72 79 2d 75 70 63 6f 6d 69 6e 67 2d 62 6f 6f 6b 69 6e 67 2d 63 61 72 64 5f 5f 63 6f 6e 74 65 6e 74 7b 70 61 64 64 69 6e 67 3a 32 34 70 78 20 33 32 70 78 20 32 34 70 78 20 35 33 70 78 7d 2e 65 6e 74 72 79 2d 75 70 63 6f 6d 69 6e 67 2d 62 6f 6f 6b 69 6e 67 2d 63 61 72 64 5f 5f 69 6d 61 67 65 7b 6d 61 72 67 69 6e 3a 30 3b 77 69 64 74 68 3a 33 36 30 70 78 3b 68 65 69 67 68 74 3a 32 Data Ascii: -header{font-size:20px;line-height:28px;font-weight:700;padding-bottom:16px}.entry-upcoming-booking-card{margin-bottom:32px}.entry-upcoming-booking-card__content{padding:24px 32px 24px 53px}.entry-upcoming-booking-card__image{margin:0;width:360px;height:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	616	OUT	GET /static/js/index_cloudfront_sd/331a3004219803fef71cbd62c4678669e7e692e4.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 23311 Connection: close Server: nginx Date: Tue, 02 Jan 2024 08:17:59 GMT Last-Modified: Wed, 20 Dec 2023 10:25:26 GMT ETag: "6582c116-5b0f" Expires: Thu, 01 Feb 2024 08:17:59 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: sxscSr2Ytzikp17lEWXJeey-hbf5rCfskfeX-6rwAl6fw-52QHDT-w== Age: 1177090
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 5f 69 5f 28 22 65 34 65 3a 35 61 61 64 39 38 37 38 22 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 72 65 61 64 79 22 2c 63 6f 6e 64 69 74 69 6f 6e 3a 42 2e 65 6e 76 2e 62 5f 70 65 72 73 6f 6e 61 6c 69 7a 65 64 5f 6c 61 79 6f 75 74 5f 69 64 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 34 65 3a 37 31 32 34 38 39 64 64 22 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 34 65 3a 64 63 61 32 34 63 63 35 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 34 65 3a 64 36 35 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};_i_("e4e:5aad9878"),B.when({events:"ready",condition:B.env.b_personalized_layout_id}).run(function(e){_i_("e4e:712489dd"),setTimeout(function(){_i_("e4e:dca24cc5"),function(e){_i_("e4e:d65
2024-01-15 23:16:09 UTC	6002	IN	Data Raw: 42 26 26 77 69 6e 64 6f 77 2e 42 2e 65 6e 76 26 26 77 69 6e 64 6f 77 2e 42 2e 65 6e 76 2e 62 5f 6c 61 6e 67 5f 66 6f 72 5f 75 72 6c 7c 7c 22 65 6e 2d 67 62 22 2c 6e 3d 72 28 27 3c 66 6f 72 6d 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 61 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 4d 79 52 65 73 2e 64 6f 3f 70 72 65 66 6c 61 6e 67 3d 27 2b 69 2b 27 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6e 74 61 63 74 2e 65 6d 61 69 6c 22 20 76 61 6c 75 65 3d 22 27 2b 28 74 7c 7c 42 2e 65 6e 76 2e 62 5f 75 73 65 72 5f 61 75 74 68 5f 75 73 65 72 6e 61 6d 65 29 2b 27 22 3e 3c 69 6e 70 75 74 20 74 Data Ascii: B&&window.B.env&&window.B.env.b_lang_for_url\|\|"en-gb",n=r('<form method="post" target="_blank" action="https://cars.booking.com/MyRes.do?preflang='+i+'"><input type="hidden" name="booking.contact.email" value="'+(t\|\|B.env.b_user_auth_username)+'"><input t
2024-01-15 23:16:09 UTC	925	IN	Data Raw: 74 2e 6f 6e 28 6e 2e 53 55 42 4d 49 54 5f 46 4f 52 4d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 34 65 3a 63 64 61 38 61 31 66 39 22 29 2c 63 28 22 71 75 69 7a 5f 73 75 62 6d 69 74 22 29 2c 5f 72 5f 28 29 7d 29 2c 74 2e 6f 6e 28 6e 2e 51 55 49 5a 5f 44 41 54 41 5f 46 41 49 4c 45 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 34 65 3a 65 34 36 63 64 39 62 34 22 29 2c 63 28 22 71 75 69 7a 5f 64 61 74 61 5f 66 61 69 6c 65 64 22 29 2c 5f 72 5f 28 29 7d 29 2c 74 2e 6f 6e 28 22 53 4c 49 44 45 5f 4f 55 54 3a 4f 50 45 4e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 34 65 3a 33 64 39 35 31 35 37 61 22 29 2c 63 28 22 6f 76 65 72 6c 61 79 5f 6f 70 65 6e 22 29 2c 5f 72 5f 28 29 7d 29 2c 74 2e 6f 6e 28 22 53 4c 49 44 45 5f 4f 55 54 3a Data Ascii: t.on(n.SUBMIT_FORM,function(){_i_("e4e:cda8a1f9"),c("quiz_submit"),_r_()}),t.on(n.QUIZ_DATA_FAILED,function(){_i_("e4e:e46cd9b4"),c("quiz_data_failed"),_r_()}),t.on("SLIDE_OUT:OPEN",function(){_i_("e4e:3d95157a"),c("overlay_open"),_r_()}),t.on("SLIDE_OUT:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49721	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	608	OUT	GET /static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 574480 Connection: close Server: nginx Date: Mon, 01 Jan 2024 17:02:41 GMT Last-Modified: Fri, 08 Dec 2023 11:23:37 GMT ETag: "6572fcb9-8c410" Expires: Wed, 31 Jan 2024 17:02:41 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: bqv7Z8bKjJGSUskE9h6B4eQDmw5GENuz9RmVaeOkglSKX-6f8QbgXA== Age: 1232008
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 75 69 2d 74 68 65 6d 65 3d 22 74 72 61 76 65 6c 6c 65 72 2d 6c 69 67 68 74 22 5d 7b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 3a 23 38 36 38 36 38 36 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 23 65 37 65 37 65 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 23 30 30 36 63 65 34 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 62 6c 65 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 64 34 31 31 31 65 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 30 30 38 32 33 34 3b 2d 2d 62 75 69 5f 63 Data Ascii: :root,[data-bui-theme="traveller-light"]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_c
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b Data Ascii: rif;--bui_font_strong_1_font-size:16px;--bui_font_strong_1_font-weight:700;--bui_font_strong_1_line-height:24px;--bui_font_strong_1_font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_strong_2_font-size:14px;
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 65 3a 34 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 38 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 42 6c 75 65 20 53 61 6e 73 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 Data Ascii: e:48px;--bui_font_display_3_font-weight:800;--bui_font_display_3_line-height:62px;--bui_font_display_3_font-family:"Blue Sans",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_1_font-size:32px;--bui_font_feat
2024-01-15 23:16:09 UTC	14808	IN	Data Raw: 61 74 75 72 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 42 6c 75 65 20 53 61 6e 73 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 Data Ascii: atured_2_line-height:28px;--bui_font_featured_2_font-family:"Blue Sans",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_3_font-size:20px;--bui_font_featured_3_font-weight:400;--bui_font_featured_3_line-heigh
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 6c 6f 72 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 66 6f 63 75 73 3a 72 67 62 61 28 32 35 35 2c 39 32 2c 39 32 2c 30 2e 32 34 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 36 31 2c 31 37 34 2c 32 35 35 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 32 35 35 2c 39 32 2c 39 32 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 36 32 36 32 36 3b 2d 2d 62 75 69 5f 63 6f 6c Data Ascii: lor_highlighted_alt:rgba(255,255,255,0.12);--bui_color_destructive_focus:rgba(255,92,92,0.24);--bui_color_action_highlighted_alt:rgba(61,174,255,0.12);--bui_color_destructive_highlighted_alt:rgba(255,92,92,0.12);--bui_color_on_background:#262626;--bui_col
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 74 69 6d 69 6e 67 2d 73 6c 6f 77 3a 33 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 73 6c 6f 77 65 72 3a 36 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 73 6c 6f 77 65 73 74 3a 31 30 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 70 61 75 73 65 64 3a 31 36 30 30 6d 73 3b 2d 2d 62 75 69 5f 62 61 73 65 6c 69 6e 65 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 70 61 64 64 69 6e 67 3a 31 32 70 78 3b 2d 2d 62 75 69 5f 6e 65 67 61 74 69 76 65 5f 70 61 64 64 69 6e 67 3a 2d 31 32 70 78 3b 2d 2d 62 75 69 5f 6d 65 64 69 75 6d 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 35 37 36 70 78 3b 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 30 32 34 70 78 3b 2d 2d 62 75 69 5f 68 75 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 32 38 30 70 78 Data Ascii: timing-slow:300ms;--bui_timing-slower:600ms;--bui_timing-slowest:1000ms;--bui_timing-paused:1600ms;--bui_baseline:24px;--bui_padding:12px;--bui_negative_padding:-12px;--bui_medium_breakpoint:576px;--bui_large_breakpoint:1024px;--bui_huge_breakpoint:1280px
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 34 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 38 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 31 36 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 32 34 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 72 29 21 69 6d 70 6f 72 Data Ascii: adding-top--4{padding-top:var(--bui_unit_small)!important}.bui-u-padding-top--8{padding-top:var(--bui_unit_medium)!important}.bui-u-padding-top--16{padding-top:var(--bui_unit_large)!important}.bui-u-padding-top--24{padding-top:var(--bui_unit_larger)!impor
2024-01-15 23:16:10 UTC	14808	IN	Data Raw: 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 62 75 69 2d 61 6c 65 72 74 2d 2d 69 6e 66 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 63 Data Ascii: argin-bottom:0}.bui-alert__text{margin:0 0 var(--bui_spacing_4x)}.bui-alert__text:first-child{margin-top:var(--bui_spacing_half)}.bui-alert__text:last-child{margin-bottom:0}.bui-alert--info{background-color:var(--bui_color_callout_background_alt);border-c
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 62 75 69 2d 62 61 6e 6e 65 72 5f 5f 63 6c 6f 73 65 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 30 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 33 70 78 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 63 75 73 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 33 70 78 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 63 75 73 29 7d 2e 62 75 69 2d 62 61 6e 6e 65 72 5f 5f 63 6c 6f 73 65 20 73 70 61 6e 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 62 75 69 2d 62 61 6e 6e 65 72 2d 2d 73 6d 61 6c 6c 7b 2d 77 65 62 6b 69 74 2d 62 Data Ascii: ver{color:var(--bui_color_foreground)}.bui-banner__close:focus{outline:0;-webkit-box-shadow:0 0 0 3px var(--bui_color_action_focus);box-shadow:0 0 0 3px var(--bui_color_action_focus)}.bui-banner__close span{pointer-events:none}.bui-banner--small{-webkit-b
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 74 72 75 63 74 69 76 65 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 61 63 74 69 76 65 3a 62 65 66 6f 72 65 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 74 65 72 74 69 61 72 79 2d 6e 65 75 74 72 61 6c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 6e 6f 74 28 2e 62 75 69 2d 69 73 2d 6c 6f 61 64 69 6e 67 29 3a 61 63 74 69 76 65 3a 62 65 66 6f 72 65 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 74 65 72 74 69 61 72 79 2d 6e 65 75 74 72 61 6c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 6e 6f 74 28 2e 62 75 69 2d 69 73 2d 6c 6f 61 64 69 6e 67 29 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 74 65 72 74 69 61 72 79 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 Data Ascii: tructive.bui-button--active:before,.bui-button--tertiary-neutral.bui-button--destructive:not(.bui-is-loading):active:before,.bui-button--tertiary-neutral.bui-button--destructive:not(.bui-is-loading):hover:before,.bui-button--tertiary.bui-button--destructi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49726	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	622	OUT	GET /static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 350307 Connection: close Server: nginx Date: Mon, 01 Jan 2024 13:50:58 GMT Last-Modified: Wed, 20 Sep 2023 10:48:00 GMT ETag: "650acde0-55863" Expires: Wed, 31 Jan 2024 13:50:58 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: oWhImTV0f_JCZW40UyRSJDlTWBQ7P7RPMQ_Cwjs8OEWLo96L6Edn7g== Age: 1243511
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 53 46 5f 75 72 6c 5f 62 75 69 6c 64 65 72 28 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 5f 69 5f 28 22 65 63 32 3a 66 64 62 31 33 38 62 36 22 29 2c 74 68 69 73 2e 62 75 63 6b 65 74 73 29 74 68 69 73 2e 62 75 63 6b 65 74 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 26 26 28 74 68 69 73 2e 62 75 63 6b 65 74 73 5b 65 5d 3d 5b 5d 29 3b 74 68 69 73 2e 70 72 6f 63 65 73 73 65 64 3d 21 31 2c 5f 72 5f 28 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 73 65 6c 65 63 74 5f 65 76 65 6e 74 5f 63 61 74 28 65 2c 74 29 7b 5f 69 5f 28 22 65 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function DSF_url_builder(){for(var e in _i_("ec2:fdb138b6"),this.buckets)this.buckets.hasOwnProperty(e)&&(this.buckets[e]=[]);this.processed=!1,_r_()}function _select_event_cat(e,t){_i_("e
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2c 74 68 69 73 2e 64 61 79 53 65 6c 65 63 74 2e 76 61 6c 28 69 29 2c 5f 72 5f 28 69 29 7d 2c 5f 62 75 69 6c 64 44 61 79 4f 70 74 69 6f 6e 73 46 6f 72 4d 6f 6e 74 68 59 65 61 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 65 63 32 3a 39 33 38 66 61 66 35 32 22 29 3b 76 61 72 20 69 2c 6e 3d 6e 65 77 20 44 61 74 65 28 65 2c 74 2c 31 29 2e 67 65 74 44 61 79 28 29 2c 6f 3d 74 68 69 73 2e 67 65 74 44 61 79 73 49 6e 4d 6f 6e 74 68 28 65 2c 74 29 2c 72 3d 5b 5d 2c 73 3d 74 68 69 73 2e 73 68 6f 77 57 65 65 6b 44 61 79 73 3b 74 68 69 73 2e 64 61 79 53 65 6c 65 63 74 2e 66 69 6e 64 28 22 6f 70 74 69 6f 6e 3a 66 69 72 73 74 22 29 2e 76 61 6c 28 29 7c 7c 72 2e 70 75 73 68 28 22 3c 6f 70 74 69 6f 6e 3e 3c 2f 6f 70 74 69 6f 6e 3e 22 29 3b 66 6f 72 28 76 Data Ascii: ,this.daySelect.val(i),_r_(i)},_buildDayOptionsForMonthYear:function(e,t){_i_("ec2:938faf52");var i,n=new Date(e,t,1).getDay(),o=this.getDaysInMonth(e,t),r=[],s=this.showWeekDays;this.daySelect.find("option:first").val()\|\|r.push("<option></option>");for(v
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 65 63 32 3a 33 37 61 39 61 34 65 65 22 29 3b 76 61 72 20 6e 3d 65 28 22 71 75 65 72 79 73 74 72 69 6e 67 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 63 32 3a 33 61 34 64 64 62 38 34 22 29 2c 5f 72 5f 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 69 3f 65 3a 6e 65 77 20 69 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 2e 70 61 72 73 65 55 72 6c 28 65 29 3a 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 38 31 64 33 33 37 64 31 22 29 2c 74 68 69 73 2e 62 61 73 65 3d 65 2e 62 61 73 65 7c 7c 22 22 2c 74 68 69 73 2e 71 75 65 72 79 3d 65 2e 71 75 65 72 79 2c 74 68 69 73 2e 68 61 73 68 3d 65 2e 68 61 73 68 3b 76 61 72 20 74 3d 74 68 69 73 2e 62 61 73 65 2e 6d 61 74 63 68 Data Ascii: ec2:37a9a4ee");var n=e("querystring");function a(e){return _i_("ec2:3a4ddb84"),_r_(e instanceof i?e:new i("string"==typeof e?n.parseUrl(e):e))}function i(e){_i_("ec2:81d337d1"),this.base=e.base\|\|"",this.query=e.query,this.hash=e.hash;var t=this.base.match
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 69 6e 64 28 7b 6d 6f 75 73 65 64 6f 77 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 35 30 33 36 32 38 39 32 22 29 2c 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 5f 72 5f 28 29 7d 2c 63 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 35 36 33 34 30 63 63 39 22 29 2c 72 28 65 2e 74 61 72 67 65 74 29 2c 5f 72 5f 28 29 7d 2c 6b 65 79 64 6f 77 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 31 61 35 66 31 63 34 34 22 29 3b 76 61 72 20 74 3d 65 2e 6b 65 79 43 6f 64 65 2c 69 3d 65 2e 74 61 72 67 65 74 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 63 3a 63 61 73 65 20 5f 3a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 65 63 32 3a 66 30 65 30 37 31 62 36 22 29 Data Ascii: ind({mousedown:function(e){_i_("ec2:50362892"),e.preventDefault(),_r_()},click:function(e){_i_("ec2:56340cc9"),r(e.target),_r_()},keydown:function(e){_i_("ec2:1a5f1c44");var t=e.keyCode,i=e.target;switch(t){case c:case _:!function(e,t){_i_("ec2:f0e071b6")
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 35 65 22 29 2c 6e 2e 63 73 73 28 22 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 22 2c 22 75 72 6c 28 22 2b 74 2b 22 29 22 29 2c 5f 72 5f 28 29 7d 2c 69 2e 73 72 63 3d 65 7d 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 28 29 2c 5f 69 5f 28 22 65 63 32 3a 65 36 62 39 32 34 66 63 22 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 72 65 61 64 79 22 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 33 65 64 32 34 36 63 33 22 29 2c 24 28 22 2e 73 68 2d 70 6f 73 74 63 61 72 64 2d 72 65 6d 6f 76 65 22 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 34 37 30 63 35 31 37 62 22 29 3b 76 61 72 20 65 3d 24 28 74 68 69 73 29 2c 74 3d 65 2e 70 61 72 65 6e 74 73 28 22 2e 73 68 2d 70 6f 73 74 63 61 Data Ascii: 5e"),n.css("background-image","url("+t+")"),_r_()},i.src=e}_r_()}),_r_()}(),_i_("ec2:e6b924fc"),B.when({events:"ready"}).run(function(){_i_("ec2:3ed246c3"),$(".sh-postcard-remove").click(function(){_i_("ec2:470c517b");var e=$(this),t=e.parents(".sh-postca
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 5f 69 5f 28 22 65 63 32 3a 66 63 62 65 61 32 31 61 22 29 2c 70 3d 21 30 2c 4f 2e 6f 66 66 28 22 74 6f 75 63 68 6d 6f 76 65 22 2c 6e 29 2c 4f 2e 6f 66 66 28 22 73 63 72 6f 6c 6c 22 2c 6e 29 2c 4f 2e 6f 66 66 28 22 72 65 73 69 7a 65 22 2c 74 29 2c 6a 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 2e 6f 66 66 28 22 73 74 69 63 6b 79 5f 6b 69 74 3a 72 65 63 61 6c 63 22 2c 74 29 2c 73 2e 6f 66 66 28 22 73 74 69 63 6b 79 5f 6b 69 74 3a 64 65 74 61 63 68 22 2c 65 29 2c 73 2e 72 65 6d 6f 76 65 44 61 74 61 28 22 73 74 69 63 6b 79 5f 6b 69 74 22 29 2c 73 2e 63 73 73 28 7b 70 6f 73 69 74 69 6f 6e 3a 22 22 2c 62 6f 74 74 6f 6d 3a 22 22 2c 74 6f 70 3a 22 22 2c 77 69 64 74 68 3a 22 22 7d 29 2c 6d 2e 70 6f 73 69 74 69 6f 6e 28 22 70 Data Ascii: unction(){if(_i_("ec2:fcbea21a"),p=!0,O.off("touchmove",n),O.off("scroll",n),O.off("resize",t),j(document.body).off("sticky_kit:recalc",t),s.off("sticky_kit:detach",e),s.removeData("sticky_kit"),s.css({position:"",bottom:"",top:"",width:""}),m.position("p
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 2e 24 70 72 65 76 41 72 72 6f 77 2e 62 69 6e 64 28 22 63 6c 69 63 6b 2e 73 6c 69 63 6b 22 2c 7b 6d 65 73 73 61 67 65 3a 22 70 72 65 76 69 6f 75 73 22 7d 2c 65 2e 63 68 61 6e 67 65 53 6c 69 64 65 29 2c 65 2e 24 6e 65 78 74 41 72 72 6f 77 2e 62 69 6e 64 28 22 63 6c 69 63 6b 2e 73 6c 69 63 6b 22 2c 7b 6d 65 73 73 61 67 65 3a 22 6e 65 78 74 22 7d 2c 65 2e 63 68 61 6e 67 65 53 6c 69 64 65 29 29 2c 5f 72 5f 28 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 44 6f 74 45 76 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 66 32 35 33 31 66 65 62 22 29 3b 76 61 72 20 65 3d 74 68 69 73 3b 21 30 3d 3d 3d 65 2e 6f 70 74 69 6f 6e 73 2e 64 6f 74 73 26 26 65 2e 73 6c 69 64 65 43 6f 75 6e 74 3e 65 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 Data Ascii: .$prevArrow.bind("click.slick",{message:"previous"},e.changeSlide),e.$nextArrow.bind("click.slick",{message:"next"},e.changeSlide)),_r_()},s.prototype.initDotEvents=function(){_i_("ec2:f2531feb");var e=this;!0===e.options.dots&&e.slideCount>e.options.slid
2024-01-15 23:16:10 UTC	13502	IN	Data Raw: 74 2e 73 74 61 72 74 58 21 3d 3d 69 2e 74 6f 75 63 68 4f 62 6a 65 63 74 2e 63 75 72 58 26 26 28 69 2e 73 6c 69 64 65 48 61 6e 64 6c 65 72 28 69 2e 63 75 72 72 65 6e 74 53 6c 69 64 65 29 2c 69 2e 74 6f 75 63 68 4f 62 6a 65 63 74 3d 7b 7d 29 3b 5f 72 5f 28 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 73 77 69 70 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 65 31 62 62 63 31 61 37 22 29 3b 76 61 72 20 74 3d 74 68 69 73 3b 69 66 28 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 7c 7c 22 6f 6e 74 6f 75 63 68 65 6e 64 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f Data Ascii: t.startX!==i.touchObject.curX&&(i.slideHandler(i.currentSlide),i.touchObject={});_r_()},s.prototype.swipeHandler=function(e){_i_("ec2:e1bbc1a7");var t=this;if(!1===t.options.swipe\|\|"ontouchend"in document&&!1===t.options.swipe)return _r_();if(!1===t.optio
2024-01-15 23:16:10 UTC	1576	IN	Data Raw: 68 69 73 2e 61 63 74 69 6f 6e 73 3d 7b 7d 3b 65 2e 73 68 6f 77 56 69 65 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 34 30 31 31 65 38 66 61 22 29 2c 74 68 69 73 2e 72 65 6e 64 65 72 28 65 2e 76 69 65 77 29 2c 5f 72 5f 28 29 7d 2c 65 2e 73 75 62 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 39 32 30 36 39 38 30 64 22 29 3b 76 61 72 20 74 3d 74 68 69 73 3b 64 2e 73 75 62 6d 69 74 4d 6f 64 65 6c 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 75 72 6c 2c 74 68 69 73 2e 6d 6f 64 65 6c 29 2e 64 6f 6e 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 34 65 65 33 30 61 64 65 22 29 3b 76 61 72 20 65 3d 74 2e 63 6f 6e 66 69 67 2e 74 69 6d 65 6f 75 74 3b 65 26 26 21 74 2e 63 6f 6e 66 69 67 2e 6e 65 76 65 Data Ascii: his.actions={};e.showView=function(e){_i_("ec2:4011e8fa"),this.render(e.view),_r_()},e.submit=function(e){_i_("ec2:9206980d");var t=this;d.submitModel(this.config.url,this.model).done(function(){_i_("ec2:4ee30ade");var e=t.config.timeout;e&&!t.config.neve
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 2c 6e 3d 6c 28 74 29 2c 6f 3d 6e 2e 64 61 74 61 28 29 3b 69 66 28 6f 2e 6d 6f 64 65 6c 26 26 28 69 3d 53 74 72 69 6e 67 28 6f 2e 6d 6f 64 65 6c 29 2e 6d 61 74 63 68 28 2f 5e 28 5b 5e 5c 5b 5c 5d 5d 2b 29 5c 5b 5c 5d 24 2f 29 29 29 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 5f 69 5f 28 22 65 63 32 3a 38 39 36 36 32 64 33 65 22 29 2c 5f 5b 6f 5d 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 5f 5b 6f 5d 3d 5b 5d 2c 63 2e 66 69 6e 64 28 27 5b 64 61 74 61 2d 6d 6f 64 65 6c 3d 22 27 2b 6f 2b 27 5b 5d 22 5d 27 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 65 63 32 3a 66 39 64 39 66 31 31 34 22 29 3b 76 61 72 20 69 3d 6c 28 74 29 2c 6e 3d 73 3f 22 22 3a 69 2e 76 61 6c 28 29 3b 69 2e 69 73 28 22 3a 63 68 65 63 6b Data Ascii: ,n=l(t),o=n.data();if(o.model&&(i=String(o.model).match(/^([^\[\]]+)\[\]$/)))return function(o){if(_i_("ec2:89662d3e"),_[o])return _r_();_[o]=[],c.find('[data-model="'+o+'[]"]').each(function(e,t){_i_("ec2:f9d9f114");var i=l(t),n=s?"":i.val();i.is(":check

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49722	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	613	OUT	GET /static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 137014 Connection: close Server: nginx Date: Tue, 02 Jan 2024 14:25:52 GMT Last-Modified: Tue, 03 Oct 2023 11:16:32 GMT ETag: "651bf810-21736" Expires: Thu, 01 Feb 2024 14:25:52 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: qyJGKDGHgulSfYbUK4e0zWVwovh3Oyix6BuuT4DgOLqmKBZnt9tYRw== Age: 1155017
2024-01-15 23:16:09 UTC	15588	IN	Data Raw: 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 61 66 63 66 66 7d 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 2d 74 6f 70 2d 6d 65 6e 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 29 3b Data Ascii: .bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 6b 69 6e 20 2e 63 32 2d 64 61 79 3a 68 6f 76 65 72 2c 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 72 61 6e 67 65 2d 61 72 72 6f 77 73 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 63 68 65 63 6b 6f 75 74 20 2e 63 32 2d 64 61 79 2d 73 2d 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 65 78 70 65 72 69 6d 65 6e 74 73 2f 63 61 6c 32 5f 64 69 72 65 63 74 69 6f 6e 61 6c 5f 61 72 72 6f 77 73 2f 33 34 62 62 61 66 36 63 34 37 33 65 32 30 33 37 31 36 34 38 30 35 38 65 34 62 35 37 32 66 32 31 30 35 38 36 62 36 65 63 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 72 61 6e 67 65 2d 61 72 Data Ascii: kin .c2-day:hover,.c2-wrapper-s-range-arrows.c2-wrapper-s-checkout .c2-day-s-selected{background:url('//cf.bstatic.com/static/img/experiments/cal2_directional_arrows/34bbaf6c473e20371648058e4b572f210586b6ec.png') no-repeat!important}.c2-wrapper-s-range-ar
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 68 74 3a 6e 6f 72 6d 61 6c 7d 2e 68 6f 74 65 6c 6c 69 73 74 20 2e 73 72 5f 69 74 65 6d 5f 63 6f 6e 74 65 6e 74 20 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 36 30 70 78 7d 2e 62 2d 62 75 73 69 6e 65 73 73 5f 5f 74 6f 6f 6c 74 69 70 3a 68 6f 76 65 72 20 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 7b 74 6f 70 3a 32 39 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 3a 62 65 66 6f 72 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 31 30 70 78 3b 6c 65 66 74 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 30 3b 68 65 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 3b 63 6f 6e 74 Data Ascii: ht:normal}.hotellist .sr_item_content .b-business-w{margin-left:-160px}.b-business__tooltip:hover .b-business-w{top:29px;display:block;opacity:1}.b-business-w:before{position:absolute;top:-10px;left:50%;display:block;width:0;height:0;margin-left:-5px;cont
2024-01-15 23:16:09 UTC	15874	IN	Data Raw: 68 65 69 67 68 74 3a 32 30 70 78 7d 2e 63 6f 6d 70 6f 6e 65 6e 74 2d 74 6f 6f 6c 74 69 70 2e 6f 6e 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 3b 6f 70 61 63 69 74 79 3a 31 3b 6d 61 72 67 69 6e 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 32 73 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 32 73 7d 2e 6c 61 6e 64 6d 61 72 6b 2d 6d 61 70 7b 77 69 64 74 68 3a 33 38 30 70 78 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 6c 69 73 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 35 30 30 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 Data Ascii: height:20px}.component-tooltip.on{visibility:visible;opacity:1;margin:0;-webkit-transition-delay:.2s;transition-delay:.2s}.landmark-map{width:380px}.sb-autocomplete__list{width:100%;min-width:500px;max-height:none;-webkit-box-sizing:border-box;-moz-box-si
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2e 2d 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2d 2d 70 61 69 6e 74 65 64 2e 2d 73 6d 61 6c 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2e 2d 73 6d 61 6c 6c 20 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 6c 61 62 65 6c 2e 2d 6d 61 69 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 68 6f 74 65 6c 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 Data Ascii: important;font-weight:normal}.sb-searchbox.-small{font-size:13px}.sb-searchbox--painted.-small{padding-left:6px;padding-right:6px}.sb-searchbox.-small .sb-searchbox__label.-main{font-size:16px}.sb-searchbox .b-form__booker-type--hotel,.sb-searchbox .b-for
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 61 72 65 6e 74 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 2e 73 62 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 20 73 65 6c 65 63 74 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 6e 6f 6e 65 7d 7d 2e 73 62 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 3a 3a 61 66 74 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 36 70 78 3b 63 6f 6e 74 65 6e 74 3a 22 5c 62 31 38 30 22 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 62 6f 6f 6b 69 6e 67 2d 69 63 6f 6e 73 65 74 27 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 70 78 7d 40 2d 6d 6f 7a 2d 64 6f 63 75 6d 65 6e 74 20 75 72 6c 2d 70 72 65 66 69 78 28 Data Ascii: arent;-webkit-appearance:none;-moz-appearance:none;appearance:none}.sb-custom-select select:focus{border-color:none}}.sb-custom-select::after{margin-top:-6px;content:"\b180";font-family:'booking-iconset';color:#333;font-size:6px}@-moz-document url-prefix(
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 6d 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 29 7d 2e 66 6c 65 78 69 62 6c 65 2d 64 61 74 65 73 2d 6d 6f 6e 74 68 20 2e 62 75 69 2d 69 6e 70 75 74 2d 63 68 65 63 6b 62 75 74 74 6f 6e 5f 5f 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 62 75 69 2d 69 6e 70 75 74 2d 63 68 65 63 6b 62 75 74 74 6f 6e 5f Data Ascii: m{color:var(--bui_color_action_foreground);border:var(--bui_border_width_100) solid var(--bui_color_action_border);background-color:var(--bui_color_action_highlighted_alt)}.flexible-dates-month .bui-input-checkbutton__input:checked~.bui-input-checkbutton_
2024-01-15 23:16:10 UTC	14808	IN	Data Raw: 6e 73 70 61 72 65 6e 74 7d 2e 62 62 74 5f 6e 65 77 5f 68 65 61 64 65 72 20 2e 6c 70 5f 66 6c 65 78 69 62 6c 65 5f 6c 61 79 6f 75 74 5f 63 6f 6e 74 65 6e 74 5f 77 72 61 70 70 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 2e 62 62 74 5f 6e 65 77 5f 68 65 61 64 65 72 2e 74 6f 75 63 68 32 2e 72 70 70 5f 75 6e 69 66 69 65 64 5f 6c 6f 67 69 6e 20 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 61 66 63 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 2e 62 62 74 5f 6e 65 77 5f 68 65 61 64 65 72 20 23 74 6f 70 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 63 6f 6c 6f 72 3a Data Ascii: nsparent}.bbt_new_header .lp_flexible_layout_content_wrapper{background-color:transparent!important}body.bbt_new_header.touch2.rpp_unified_login #bodyconstraint{background:#fafcff!important}body.bbt_new_header #top{background:var(--bui_color_white);color:
2024-01-15 23:16:10 UTC	8824	IN	Data Raw: 65 78 74 5f 5f 62 6f 64 79 2d 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 6d 61 72 67 69 6e 3a 30 3b 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 38 29 7d 2e 73 72 2d 69 74 65 6d 2d 62 61 Data Ascii: ext__body-text{font-size:var(--bui_font_body_2_font-size);font-weight:var(--bui_font_body_2_font-weight);line-height:var(--bui_font_body_2_line-height);font-family:var(--bui_font_body_2_font-family);margin:0;text-shadow:0 2px 2px rgba(0,0,0,8)}.sr-item-ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49727	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	620	OUT	GET /static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 247198 Connection: close Server: nginx Date: Tue, 02 Jan 2024 08:17:59 GMT Last-Modified: Fri, 17 Nov 2023 14:07:08 GMT ETag: "6557738c-3c59e" Expires: Thu, 01 Feb 2024 08:17:59 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AS_RRZErkbtiDtmw0TcyDZa61EQ5kKWx_OTaIKFxDldKZUJ1v07qUQ== Age: 1177090
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 73 65 61 72 63 68 62 6f 78 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 61 72 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 35 30 61 35 64 36 61 61 22 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 7b 67 65 74 50 6f 73 69 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 69 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchbox={loaded:!0,run:!1}),B.define("caret",function(){_i_("4ab:50a5d6aa");return _r_({getPosition:function(e){var t;i
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 62 65 20 61 20 73 74 72 69 6e 67 22 29 3b 69 66 28 22 22 3d 3d 3d 28 65 3d 65 2e 74 72 69 6d 28 29 29 29 72 65 74 75 72 6e 20 5f 72 5f 28 73 29 3b 72 65 74 75 72 6e 20 65 2e 73 70 6c 69 74 28 2f 5c 73 2b 2f 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 61 62 3a 37 37 64 31 32 66 64 38 22 29 3b 76 61 72 20 74 2c 69 3d 65 2c 61 3d 21 30 2c 6e 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3a 22 29 3b 2d 31 21 3d 3d 6e 26 26 28 69 3d 65 2e 73 75 62 73 74 72 28 30 2c 6e 29 2c 28 61 3d 65 2e 73 75 62 73 74 72 28 6e 2b 31 29 29 7c 7c 28 61 3d 30 29 2c 74 3d 61 2c 5f 69 5f 28 22 34 61 62 3a 63 66 38 39 33 61 37 61 22 29 2c 5f 72 5f 28 21 69 73 4e 61 4e 28 70 61 72 73 65 46 6c 6f 61 74 28 74 29 29 26 26 69 73 46 69 6e 69 74 65 28 74 29 Data Ascii: be a string");if(""===(e=e.trim()))return _r_(s);return e.split(/\s+/).forEach(function(e){_i_("4ab:77d12fd8");var t,i=e,a=!0,n=e.indexOf(":");-1!==n&&(i=e.substr(0,n),(a=e.substr(n+1))\|\|(a=0),t=a,_i_("4ab:cf893a7a"),_r_(!isNaN(parseFloat(t))&&isFinite(t)
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 65 66 74 22 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 65 29 7d 2c 5f 70 6c 61 63 65 54 6f 6f 6c 74 69 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 65 65 66 64 31 63 62 35 22 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 5f 61 63 63 6f 75 6e 74 46 6f 72 52 54 4c 28 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 29 2c 74 3d 74 68 69 73 2e 64 69 6d 65 6e 73 69 6f 6e 3b 74 68 69 73 2e 5f 61 63 63 6f 75 6e 74 46 6f 72 52 54 4c 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 70 6c 61 63 65 6d 65 6e 74 29 3d 3d 3d 65 3f 74 68 69 73 5b 65 5d 3d 74 68 69 73 2e 65 6c 4f 66 66 73 65 74 5b 65 5d 2d 74 68 69 73 2e 24 74 69 70 5b 74 5d 28 29 3a 74 68 69 73 5b 65 5d 3d 74 68 69 73 2e 65 6c 4f 66 66 73 65 74 5b 65 5d 2b 74 68 69 73 2e 24 65 6c 5b 74 5d 28 29 2c 5f 72 5f 28 Data Ascii: eft");return _r_(e)},_placeTooltip:function(){_i_("4ab:eefd1cb5");var e=this._accountForRTL(this.position),t=this.dimension;this._accountForRTL(this.options.placement)===e?this[e]=this.elOffset[e]-this.$tip[t]():this[e]=this.elOffset[e]+this.$el[t](),_r_(
2024-01-15 23:16:09 UTC	14808	IN	Data Raw: 28 22 2d 76 69 73 69 62 6c 65 22 29 29 2c 5f 72 5f 28 29 7d 2c 68 69 64 65 4c 6f 61 64 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 35 37 61 33 61 30 62 30 22 29 2c 74 68 69 73 2e 73 68 6f 75 6c 64 53 68 6f 77 4c 6f 61 64 69 6e 67 53 74 61 74 65 26 26 74 68 69 73 2e 24 6c 6f 61 64 69 6e 67 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 2d 76 69 73 69 62 6c 65 22 29 2c 5f 72 5f 28 29 7d 2c 6d 6f 64 65 6c 49 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 31 63 30 63 30 65 65 35 22 29 3b 76 61 72 20 65 3d 7b 73 73 3a 74 68 69 73 2e 69 6e 70 75 74 2e 76 61 6c 75 65 7d 3b 74 68 69 73 2e 64 65 73 74 69 6e 61 74 69 6f 6e 4d 6f 64 65 6c 2e 69 6e 69 74 28 65 29 2c 5f 72 5f 28 29 7d 2c 6d 6f 64 65 6c 43 68 61 6e 67 65 Data Ascii: ("-visible")),_r_()},hideLoading:function(){_i_("4ab:57a3a0b0"),this.shouldShowLoadingState&&this.$loading.removeClass("-visible"),_r_()},modelInit:function(){_i_("4ab:1c0c0ee5");var e={ss:this.input.value};this.destinationModel.init(e),_r_()},modelChange
2024-01-15 23:16:09 UTC	267	IN	Data Raw: 61 67 28 22 6f 6e 5f 63 6c 69 63 6b 5f 73 75 67 67 65 73 74 69 6f 6e 73 5f 61 6e 79 77 68 65 72 65 22 29 26 26 28 74 2e 61 6e 79 77 68 65 72 65 3d 21 30 29 2c 73 2e 62 5f 61 63 5f 73 65 61 72 63 68 5f 68 69 73 74 6f 72 79 26 26 74 68 69 73 2e 6d 6f 64 65 6c 2e 67 65 74 46 6c 61 67 28 22 6f 6e 5f 63 6c 69 63 6b 5f 73 75 67 67 65 73 74 69 6f 6e 73 22 29 26 26 28 74 2e 73 65 61 72 63 68 48 69 73 74 6f 72 79 3d 21 30 29 2c 74 68 69 73 2e 6d 6f 64 65 6c 2e 75 73 65 28 22 67 72 6f 75 70 22 29 2c 74 68 69 73 2e 6d 6f 64 65 6c 2e 6f 6e 28 22 69 6e 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 61 62 3a 34 36 64 36 39 39 38 39 22 29 2c 22 67 72 6f 75 70 22 3d 3d 3d 65 2e 67 72 6f 75 70 26 26 74 68 69 73 2e 66 65 74 63 68 53 75 67 67 65 73 74 69 Data Ascii: ag("on_click_suggestions_anywhere")&&(t.anywhere=!0),s.b_ac_search_history&&this.model.getFlag("on_click_suggestions")&&(t.searchHistory=!0),this.model.use("group"),this.model.on("init",function(e){_i_("4ab:46d69989"),"group"===e.group&&this.fetchSuggesti
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 7d 2e 62 69 6e 64 28 74 68 69 73 29 29 29 2c 74 68 69 73 2e 6d 6f 64 65 6c 26 26 74 68 69 73 2e 6d 6f 64 65 6c 2e 67 65 74 46 6c 61 67 26 26 74 68 69 73 2e 6d 6f 64 65 6c 2e 67 65 74 46 6c 61 67 28 22 77 69 74 68 5f 72 65 63 65 6e 74 5f 73 65 61 72 63 68 22 29 26 26 28 74 68 69 73 2e 6d 6f 64 65 6c 2e 75 73 65 28 22 72 65 63 65 6e 74 53 65 61 72 63 68 22 29 2c 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 73 43 61 63 68 65 26 26 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 73 43 61 63 68 65 2e 72 65 73 75 6c 74 73 26 26 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 73 43 61 63 68 65 2e 72 65 73 75 6c 74 73 2e 6c 65 6e 67 74 68 7c 7c 28 74 68 69 73 2e 73 75 67 67 65 73 74 69 6f 6e 73 43 61 63 68 65 3d 7b 72 65 73 75 6c 74 73 3a 74 68 69 73 2e 6d 6f 64 65 6c Data Ascii: }.bind(this))),this.model&&this.model.getFlag&&this.model.getFlag("with_recent_search")&&(this.model.use("recentSearch"),this.suggestionsCache&&this.suggestionsCache.results&&this.suggestionsCache.results.length\|\|(this.suggestionsCache={results:this.model
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 2c 69 28 6e 65 77 20 45 72 72 6f 72 28 22 73 65 72 76 69 63 65 2d 61 74 6c 61 73 2d 74 6f 6f 2d 73 68 6f 72 74 2d 73 65 61 72 63 68 2d 73 74 72 69 6e 67 22 29 2c 7b 7d 29 2c 5f 72 5f 28 29 7d 2c 34 29 2c 5f 72 5f 28 7b 67 65 74 44 65 74 61 69 6c 73 3a 24 2e 6e 6f 6f 70 2c 61 62 6f 72 74 3a 24 2e 6e 6f 6f 70 7d 29 3b 69 66 28 21 63 28 29 29 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 63 34 38 36 36 35 33 34 22 29 2c 69 28 6e 65 77 20 45 72 72 6f 72 28 22 73 65 72 76 69 63 65 2d 61 74 6c 61 73 2d 6e 6f 2d 61 74 6c 61 73 22 29 2c 6e 75 6c 6c 29 2c 5f 72 5f 28 29 7d 2c 34 29 2c 5f 72 5f 28 7b 67 65 74 44 65 74 61 69 6c 73 3a 24 2e 6e 6f 6f 70 2c 61 62 6f 72 74 3a 24 2e 6e 6f 6f 70 7d 29 3b Data Ascii: ,i(new Error("service-atlas-too-short-search-string"),{}),_r_()},4),_r_({getDetails:$.noop,abort:$.noop});if(!c())return setTimeout(function(){_i_("4ab:c4866534"),i(new Error("service-atlas-no-atlas"),null),_r_()},4),_r_({getDetails:$.noop,abort:$.noop});
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 72 65 73 73 22 2c 74 68 69 73 2e 69 6e 70 75 74 4b 65 79 50 72 65 73 73 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 42 2e 65 76 65 6e 74 45 6d 69 74 74 65 72 2e 6f 6e 28 22 43 41 4c 45 4e 44 41 52 3a 73 68 6f 77 6e 20 43 41 4c 45 4e 44 41 52 3a 63 6c 6f 73 65 64 22 2c 74 68 69 73 2e 75 70 64 61 74 65 46 6f 63 75 73 43 6c 61 73 73 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 53 74 61 74 65 3d 7b 7d 2c 74 68 69 73 2e 73 74 61 74 65 3d 7b 65 64 69 74 69 6e 67 3a 21 31 2c 63 75 72 72 65 6e 74 46 69 65 6c 64 3a 6e 75 6c 6c 7d 2c 74 68 69 73 2e 63 68 65 63 6b 44 61 74 65 46 69 65 6c 64 73 28 29 2c 74 68 69 73 2e 69 6e 69 74 4d 6f 64 65 6c 28 29 2c 5f 72 5f 28 29 7d 2c 63 68 65 63 6b 44 61 74 65 46 69 65 6c 64 73 3a 66 75 6e 63 74 69 Data Ascii: ress",this.inputKeyPress.bind(this)),B.eventEmitter.on("CALENDAR:shown CALENDAR:closed",this.updateFocusClass.bind(this)),this.previousState={},this.state={editing:!1,currentField:null},this.checkDateFields(),this.initModel(),_r_()},checkDateFields:functi
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 70 65 22 29 3b 69 66 28 22 64 61 79 22 21 3d 3d 74 26 26 22 6d 6f 6e 74 68 22 21 3d 3d 74 26 26 22 79 65 61 72 22 21 3d 3d 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 20 66 72 61 67 6d 65 6e 74 22 29 3b 76 61 72 20 6e 3d 31 2c 73 3d 69 2b 61 3b 72 65 74 75 72 6e 22 6d 6f 6e 74 68 22 3d 3d 74 3f 6e 3d 30 3a 22 79 65 61 72 22 3d 3d 74 26 26 28 6e 3d 74 68 69 73 2e 5f 64 61 74 61 2e 66 69 72 73 74 56 61 6c 69 64 44 61 79 2e 79 65 61 72 29 2c 73 3c 6e 26 26 28 73 3d 6e 29 2c 5f 72 5f 28 74 68 69 73 2e 73 65 74 45 64 69 74 69 6e 67 46 72 61 67 6d 65 6e 74 28 65 2c 74 2c 73 29 29 7d 2c 61 70 70 6c 79 45 64 69 74 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 5f 69 5f 28 22 34 61 62 3a 62 63 65 33 61 61 62 Data Ascii: pe");if("day"!==t&&"month"!==t&&"year"!==t)throw new TypeError("invalid fragment");var n=1,s=i+a;return"month"==t?n=0:"year"==t&&(n=this._data.firstValidDay.year),s<n&&(s=n),_r_(this.setEditingFragment(e,t,s))},applyEditing:function(e){if(_i_("4ab:bce3aab
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 6e 61 6d 65 3d 22 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 6d 69 6e 3d 22 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 6d 61 78 3d 22 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 3d 22 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 27 2c 27 20 5c 6e 20 20 20 20 20 20 20 20 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 5c 6e 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 20 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 73 65 63 6f 6e 64 61 72 79 20 62 75 69 2d 73 74 65 70 70 65 72 5f 5f 73 75 62 74 72 61 63 74 2d 62 75 74 74 6f 6e 20 27 2c 22 73 62 2d 67 72 6f 75 70 5f 5f 73 74 65 70 70 65 72 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 22 2c Data Ascii: ','"\n name="','"\n min="','"\n max="','"\n value="','"\n ',' \n />\n <button\n class="bui-button bui-button--secondary bui-stepper__subtract-button ',"sb-group__stepper-button-disabled",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49717	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	615	OUT	GET /static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:09 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 76128 Connection: close Server: nginx Date: Tue, 02 Jan 2024 14:10:01 GMT Last-Modified: Fri, 28 Jul 2023 11:29:03 GMT ETag: "64c3a67f-12960" Expires: Thu, 01 Feb 2024 14:10:01 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cuA__N1L5Rghu7JaLcXwz7pQ1y8D4Xi5MdXgk6RKAKfstz8Uq6GPHg== Age: 1155968
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 61 66 63 66 66 7d 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 2d 74 6f 70 2d 6d 65 6e 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 29 3b Data Ascii: .bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 74 69 6f 6e 3a 72 69 67 68 74 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 31 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 6c 65 66 74 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 67 6e 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 33 35 70 78 3b 6c 65 66 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 32 30 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 Data Ascii: tion:right}.tooltip-right{margin-right:0;padding-right:0;margin-left:5px;padding-left:11px}.tooltip-right .tooltip-arrow{right:auto;left:0;width:12px;background-position:left}.tooltip-align-right .tooltip-arrow{right:35px;left:auto;width:20px}.tooltip-ali
2024-01-15 23:16:09 UTC	16384	IN	Data Raw: 62 6f 78 2d 2d 70 61 69 6e 74 65 64 2e 2d 73 6d 61 6c 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2e 2d 73 6d 61 6c 6c 20 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 6c 61 62 65 6c 2e 2d 6d 61 69 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 68 6f 74 65 6c 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 69 6e 64 65 78 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 70 72 6f 66 69 6c 65 2c 2e 73 62 2d 73 65 61 72 63 Data Ascii: box--painted.-small{padding-left:6px;padding-right:6px}.sb-searchbox.-small .sb-searchbox__label.-main{font-size:16px}.sb-searchbox .b-form__booker-type--hotel,.sb-searchbox .b-form__booker-type--index,.sb-searchbox .b-form__booker-type--profile,.sb-searc
2024-01-15 23:16:09 UTC	15077	IN	Data Raw: 6f 6c 64 65 72 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 74 79 70 65 5f 5f 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 62 61 64 67 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 69 74 65 6d 2d 2d 74 61 62 62 65 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 38 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 Data Ascii: older-text{height:24px}.destination-type__wrapper{display:inline-block;margin:0 0 0 8px;display:none}.sb-autocomplete__badge{font-size:12px;line-height:18px;font-weight:700;margin:0 0 0 8px}.sb-autocomplete__item--tabbed{padding-left:80px!important;backgr
2024-01-15 23:16:09 UTC	11899	IN	Data Raw: 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 3a 30 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 70 61 64 64 69 6e 67 3a 34 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6d 61 72 67 69 6e 3a 32 34 70 78 20 30 20 31 36 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 Data Ascii: olor_foreground);border:0;display:table;background-color:var(--bui_color_accent_background);padding:4px;border-radius:var(--bui_border_radius_200);margin:24px 0 16px;position:relative;width:100%;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49730	23.221.45.212	443

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:09 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-01-15 23:16:09 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=215078 Date: Mon, 15 Jan 2024 23:16:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-01-15 23:16:09 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/dc32f6b7.3591890c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4522 Connection: close Last-Modified: Mon, 08 Jan 2024 12:44:59 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 9LhIuLvPk7ch4sOG5AEZ_ZYo835EgU99 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 15:40:32 GMT ETag: "003b2b00090f78d14adbd6372657c992" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: is3HQijxYPC0f4C1mngny9jxPDi0r8FXxv7y34gb-d_8hIpUs6IOvQ== Age: 27339 Vary: Origin
2024-01-15 23:16:10 UTC	3198	IN	Data Raw: 2e 61 66 30 36 39 30 33 31 66 66 7b 6d 61 72 67 69 6e 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 2a 2d 31 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 66 30 36 39 30 33 31 66 66 20 73 76 67 7b 68 65 69 67 68 74 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 61 38 37 38 38 61 62 62 61 65 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 65 78 74 2d 74 6f 70 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 64 32 63 30 30 39 34 64 61 39 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 66 64 37 34 30 63 34 63 Data Ascii: .af069031ff{margin:calc(var(--bui_spacing_3x)*-1);padding:var(--bui_spacing_2x)}.af069031ff svg{height:100%!important}.a8788abbae{vertical-align:text-top;margin-inline-start:var(--bui_spacing_2x)}.d2c0094da9{color:var(--bui_color_foreground_alt)}.fd740c4c
2024-01-15 23:16:10 UTC	1324	IN	Data Raw: 23 66 66 66 7d 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 61 63 74 69 76 65 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 68 6f 76 65 72 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 6c 69 6e 6b 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 76 69 73 69 74 65 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 6d 6f 64 61 6c 5d 20 61 3a 61 63 74 69 76 65 2c 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 6d 6f 64 61 6c 5d 20 61 3a 68 6f 76 65 72 2c 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 Data Ascii: #fff}.web-shell-header-mfe a:active,.web-shell-header-mfe a:hover,.web-shell-header-mfe a:link,.web-shell-header-mfe a:visited{font-weight:500}[data-testid=header-mobile-menu-modal] a:active,[data-testid=header-mobile-menu-modal] a:hover,[data-testid=head

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/18cad957.5bf0bb6a.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	613	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 351 Connection: close Last-Modified: Sun, 14 Jan 2024 05:16:10 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: As6.DTNJxnZs1jT1bT0xxnPT6YIyVXo_ Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:11 GMT ETag: "fb137f494a827cc056da24be63156f24" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: MecN9z5AJ9Lr7g3kjsISd3hFfi-HG1dgErQkmhj3xtbwqzk9J3lRgA== Vary: Origin
2024-01-15 23:16:10 UTC	351	IN	Data Raw: 2e 61 34 38 61 39 39 31 66 61 36 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 63 30 64 64 31 34 33 37 39 36 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 62 75 69 5f 73 68 61 64 6f 77 5f 31 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 62 65 37 39 61 34 64 37 62 31 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 66 64 32 64 31 36 30 61 31 62 7b 6d 61 72 67 69 6e 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 0a 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 Data Ascii: .a48a991fa6{display:none}.c0dd143796{border-radius:var(--bui_spacing_2x);box-shadow:var(--bui_shadow_100);overflow:hidden}.be79a4d7b1{margin-bottom:var(--bui_spacing_6x)}.fd2d160a1b{margin:0 var(--bui_spacing_3x) var(--bui_spacing_4x)}/*# sourceMappingUR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49735	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	686	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:48:06 GMT Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: sKiB-JZkSB3QI3Ht8MaIQ1vqSxAwM4JJicAxxtOR9ZHwKNWgt_ntWw== Age: 2111284
2024-01-15 23:16:10 UTC	15835	IN	Data Raw: 39 39 61 30 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 99a0PNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: dc ad 65 1e 05 7d d2 fc 34 b9 2f de 8f 26 e8 ff fe af bb a0 ff b7 db ec ba 8c 44 e4 ea 6a 4a de 52 4b 5d 06 bb ff 3e 2c c8 69 45 46 1a b7 bc 82 d2 4b ed 32 cb 13 b9 7c a3 c7 6c 4c d8 8a 22 99 42 d6 be 73 e9 81 1a e1 04 b9 ff 1f 7a 8e 5a 24 9b 83 12 8b 6c 52 cc 37 1d 74 d0 cb 5f 4d 77 2b f7 d0 7f 46 d0 ea bd 0e f9 3b 69 75 4e 08 48 f5 f8 5b 6f d9 75 4c fe ae 87 55 c7 71 4f 05 67 84 ec 2e ce ee a1 6a d7 f3 c6 99 8c 5d 65 36 8f d7 d7 e7 3d 02 a4 a0 73 ea 9d 9b 59 76 89 fa fe f7 5b a0 5b b9 bf 3c dd 57 a6 d8 b9 7f 8c 16 a5 fb 44 66 bb 95 e3 df 6b 61 fa 2e 99 d5 d2 8e 8d cf d1 8e 32 87 dc 66 e3 41 65 ca c7 7f a0 d2 5d d0 9f ff 74 a2 5b 9d ff f7 e5 14 59 9e eb e4 a9 96 5d e3 ff c5 21 e1 08 3b 9a d9 a1 ae 6a d9 6b 64 af de a5 7c 34 ed a3 23 85 53 e8 96 c7 5d ef Data Ascii: e}4/&DjJRK]>,iEFK2\|lL"BszZ$lR7t_Mw+F;iuNH[ouLUqOg.j]e6=sYv[[<WDfka.2fAe]t[Y]!;jkd\|4#S]
2024-01-15 23:16:10 UTC	7117	IN	Data Raw: cb 43 17 94 c8 90 f9 78 66 7d a9 bc 96 b8 c7 48 da 2b d7 bd 1b 5a 42 d4 9e c8 b1 8e 7d de 7e b3 d4 fd 37 7e 90 67 d6 5f 1e b9 e3 db 8f 90 58 79 4c 5a 1c 4f 22 2b d5 48 7b a3 ee 5f a0 eb 71 48 8b a7 ae f0 bd 9a b2 d2 ff 64 52 b6 af 86 46 da b5 12 56 94 fc 2e 35 5b 7e cb 6f 43 42 7e 04 dc d4 7e f1 45 0f 7f b2 f1 ca db bb ae ba b1 f5 f8 c3 37 3e 39 74 db 23 4f 0e d9 dc f0 bf 53 8b 9b dd d3 b3 60 c4 73 a3 76 0d 53 41 66 34 4a dc bd f4 89 c1 9b f7 bd 36 66 ff 3e 8d ee 8f a8 08 fd 6f 8f 2b 2a 47 1a 1f 02 6d a2 d1 7f dd 4f f4 0b 74 30 84 b8 5e 85 ba 45 5e 18 b5 43 f4 1a 79 4e 25 8b 63 0d 86 6d 35 99 01 48 b2 b1 46 2c 88 8c 9b a7 ec 36 52 86 40 9f 53 e1 36 18 b6 45 af d1 6d bd 1e 15 88 ff f4 59 67 a2 64 5c 5b ef 93 8d 2a e5 1d 52 7b c0 7a a9 3d 70 bd 8b a2 b7 1b Data Ascii: Cxf}H+ZB}~7~g_XyLZO"+H{_qHdRFV.5[~oCB~~E7>9t#OS`svSAf4J6f>o+GmOt0^E^CyN%cm5HF,6R@S6EmYgd\[R{z=p
2024-01-15 23:16:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49732	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	628	OUT	GET /static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 6155 Connection: close Server: nginx Date: Sat, 30 Dec 2023 09:19:55 GMT Last-Modified: Wed, 21 Dec 2022 14:29:30 GMT ETag: "63a3184a-180b" Expires: Mon, 29 Jan 2024 09:19:55 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: OoIi6m01x6bWNoZoNL5wLARdivQDwjEybybxE_JYRaDDJDWaqfX-5g== Age: 1432575
2024-01-15 23:16:10 UTC	6155	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 6c 2c 5f 2c 66 29 7b 76 61 72 20 73 2c 75 3d 5b 5d 2c 6f 3d 21 21 67 28 29 3b 66 75 6e 63 74 69 6f 6e 20 67 28 29 7b 76 61 72 20 65 3b 69 66 28 6c 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 74 72 79 7b 65 3d 6e 65 77 20 6c 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 65 6c 73 65 20 66 6f 72 28 76 61 72 20 72 3d 6e 65 77 20 41 72 72 61 79 28 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 35 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 34 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 33 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50 22 29 2c 74 3d 30 3b 74 3c 72 2e 6c Data Ascii: !function(l,_,f){var s,u=[],o=!!g();function g(){var e;if(l.XMLHttpRequest)try{e=new l.XMLHttpRequest}catch(e){return!1}else for(var r=new Array("Msxml2.XMLHTTP.5.0","Msxml2.XMLHTTP.4.0","Msxml2.XMLHTTP.3.0","Msxml2.XMLHTTP","Microsoft.XMLHTTP"),t=0;t<r.l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49731	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	567	OUT	GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	621	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 194024 Connection: close Date: Mon, 15 Jan 2024 13:45:31 GMT Last-Modified: Mon, 15 Jan 2024 13:45:30 GMT ETag: "65adf2d4363bba13d63bbc403b0b3cce" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: u3cn6Ed7thVPXGQQa79hHShJJmXcB4zJ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 2b-JSRQaLRLc-w-EIjOs6LOzYkgtby34sLO11_xxIZxjy5TQm9OwoQ== Age: 34240 Vary: Origin
2024-01-15 23:16:10 UTC	15763	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 75 69 2d 74 68 65 6d 65 3d 6c 65 67 61 63 79 2d 6c 69 67 68 74 5d 7b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 23 65 37 65 37 65 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 23 30 30 37 31 63 32 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 62 6c 65 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 63 30 30 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 30 30 38 30 30 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 34 39 34 39 34 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 Data Ascii: :root,[data-bui-theme=legacy-light]{--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#0071c2;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#c00;--bui_color_constructive_border:#008009;--bui_color_background:#494949;--bui_color
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 3a 34 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 Data Ascii: ns-serif;--bui_font_display_3_font-size:48px;--bui_font_display_3_font-weight:700;--bui_font_display_3_line-height:62px;--bui_font_display_3_font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_1_font
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 7d 2e 63 30 38 32 64 38 39 39 38 32 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 63 30 38 32 64 38 39 39 38 32 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 63 30 38 32 64 38 39 39 38 32 2e 63 39 62 33 36 62 36 63 63 37 2c 2e Data Ascii: ound_disabled);border-color:var(--bui_color_background_disabled)}.c082d89982{color:var(--bui_color_on_cta_background)}.c082d89982:before{background-color:var(--bui_color_cta_background);border-color:var(--bui_color_cta_background)}.c082d89982.c9b36b6cc7,.
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 7d 2e 63 37 61 61 35 37 35 33 35 65 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 7d 2e 66 32 63 65 38 31 65 32 65 65 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 2d 72 65 76 65 72 73 65 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e 65 61 63 35 61 66 31 61 64 35 7b 66 6c 65 78 2d 77 72 61 70 3a 69 6e 69 74 69 61 6c 3b 66 6c 65 Data Ascii: lex-direction:column-reverse;align-items:stretch}.c7aa57535e{flex-direction:row;flex-wrap:wrap;align-items:flex-start}.f2ce81e2ee{flex-direction:row-reverse;flex-wrap:wrap;align-items:flex-start}}@media (min-width:1280px){.eac5af1ad5{flex-wrap:initial;fle
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 66 39 39 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 69 6e 6c 69 6e 65 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 65 36 32 30 38 65 65 34 36 39 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 66 34 35 64 38 65 34 63 33 32 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 65 62 34 34 61 30 33 38 33 38 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 Data Ascii: f99{margin-inline:calc(var(--bui_spacing_4x)*-1)!important;border-radius:0!important;border-inline:0!important}}.e6208ee469{color:var(--bui_color_foreground)}.f45d8e4c32{color:var(--bui_color_foreground_alt)}.eb44a03838{color:var(--bui_color_action_foregr
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 61 63 66 32 32 34 33 65 34 36 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 36 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 Data Ascii: _font_headline_3_font-size);font-weight:var(--bui_font_headline_3_font-weight);line-height:var(--bui_font_headline_3_line-height);font-family:var(--bui_font_headline_3_font-family)}.acf2243e46{height:calc(var(--bui_spacing_1x)*16);width:calc(var(--bui_spa
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 7d 2e 64 66 35 31 66 32 66 30 33 61 20 2e 64 33 35 38 35 35 36 63 36 35 7b 70 61 64 64 69 6e 67 3a 30 3b 70 61 64 64 69 6e 67 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 64 66 35 31 66 32 66 30 33 61 20 2e 64 33 35 38 35 35 36 63 36 35 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 70 61 64 64 69 6e 67 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 30 7d 2e 64 66 35 31 66 32 66 30 33 61 20 2e 64 63 37 32 61 38 34 31 33 63 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 64 66 35 31 66 32 66 30 33 61 20 2e 65 65 37 65 63 36 62 36 33 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e Data Ascii: -bui_spacing_8x);flex-grow:1}.df51f2f03a .d358556c65{padding:0;padding-block-start:var(--bui_spacing_4x)}.df51f2f03a .d358556c65:first-child{padding-block-start:0}.df51f2f03a .dc72a8413c{display:none}.df51f2f03a .ee7ec6b631{text-align:start;justify-conten
2024-01-15 23:16:10 UTC	15812	IN	Data Raw: 64 74 68 3a 63 61 6c 63 28 38 2e 33 33 33 33 33 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 63 38 37 32 64 32 37 31 66 30 7b 77 69 64 74 68 3a 63 61 6c 63 28 31 36 2e 36 36 36 36 37 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 66 65 34 38 37 63 62 36 61 32 7b 77 69 64 74 68 3a 63 61 6c 63 28 32 35 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 66 66 37 64 66 65 37 35 37 65 7b 77 69 64 74 68 3a 63 61 6c 63 28 33 33 2e 33 33 33 33 33 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 65 65 30 35 63 39 35 31 63 63 7b 77 69 64 74 68 3a 63 61 6c 63 28 34 31 2e 36 36 36 36 37 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 Data Ascii: dth:calc(8.33333% - var(--bui_stack_gap))}.c872d271f0{width:calc(16.66667% - var(--bui_stack_gap))}.fe487cb6a2{width:calc(25% - var(--bui_stack_gap))}.ff7dfe757e{width:calc(33.33333% - var(--bui_stack_gap))}.ee05c951cc{width:calc(41.66667% - var(--bui_sta
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 65 61 63 30 62 36 65 35 62 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 35 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 65 61 63 30 62 36 65 35 62 61 3a 65 6d 70 74 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 65 61 63 30 62 36 65 35 62 61 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 65 61 63 30 62 36 65 35 62 61 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 76 61 72 28 2d 2d Data Ascii: r_foreground)}.eac0b6e5ba{position:relative;z-index:5;display:flex;justify-content:center;white-space:nowrap}.eac0b6e5ba:empty{display:none}.eac0b6e5ba:first-child{padding-inline-start:var(--bui_spacing_2x)}.eac0b6e5ba:last-child{padding-inline-end:var(--
2024-01-15 23:16:10 UTC	16384	IN	Data Raw: 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 29 7d 2e 64 39 64 66 39 66 35 61 30 63 20 2e 64 62 37 62 66 37 37 64 63 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 6f 70 61 63 69 74 79 3a 2e 35 7d 2e 64 39 64 66 39 66 35 61 30 63 20 2e 61 65 36 34 39 65 63 38 63 66 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 65 37 64 34 61 34 66 30 35 62 20 2e 61 39 38 38 33 66 65 36 37 35 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 29 7d 2e 61 61 66 33 31 38 62 65 66 37 20 2e 61 39 38 38 33 66 65 36 37 35 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 Data Ascii: action_border)}.d9df9f5a0c .db7bf77dce{background:var(--bui_color_white);opacity:.5}.d9df9f5a0c .ae649ec8cf{opacity:1}.e7d4a4f05b .a9883fe675{transform:translateX(var(--bui_spacing_4x))}.aaf318bef7 .a9883fe675{transform:translateX(calc(var(--bui_spacing_4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49736	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	617	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2861 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:04 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Cyf6v5nj2E7qIBxHNxNY_fCizTCYbI1U Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:10 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Fi8Df3JkNn_DSn98HmPQIbYTlARyqvdxlSt2UdNGKwOeEXr3VLTbsA== Age: 255 Vary: Origin
2024-01-15 23:16:10 UTC	2861	IN	Data Raw: 2e 62 63 34 65 32 63 34 36 37 61 7b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 62 38 65 39 32 30 65 30 38 38 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 33 30 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d Data Ascii: .bc4e2c467a{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;margin-bottom:var(--bui_spacing_6x);position:relative}.b8e920e088{text-decoration:none;text-align:center;display:flex;justify-content:flex-end;min-height:230px;padding:var(--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49737	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1501 Connection: close Last-Modified: Fri, 12 Jan 2024 16:20:06 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Ukxg3naZ6RIMZfHmzISeYJ28SV5gPagG Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 01:19:13 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: XXGz_RUOVmm3pA35zbfJC8jIuzj7q71bZ_VUggPAwEVh5hLZtT8MOA== Age: 79018 Vary: Origin
2024-01-15 23:16:10 UTC	1501	IN	Data Raw: 2e 66 33 39 35 65 35 32 32 62 64 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 66 62 30 65 38 34 39 31 66 32 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 61 66 30 63 32 31 32 32 66 61 7b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 30 7d 2e 64 34 31 32 38 30 32 36 35 32 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 Data Ascii: .f395e522bd{width:100%;height:100%;display:flex;flex-direction:row}.fb0e8491f2{margin-block-end:var(--bui_spacing_4x)}.af0c2122fa{margin:var(--bui_spacing_4x) 0}.d412802652{height:100%;width:100%;position:relative;border:1px solid var(--bui_color_white);b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49738	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	595	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 853 Connection: close Date: Mon, 15 Jan 2024 04:19:28 GMT Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1FYxBAlnpir4aMeZTk4ZcxEZA4fQWxaq Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 ec809871438c11b540493503de981368.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: pyp0zNv9EeqRNpw2NoR3wpFtqVnH8coVjEQ67q8dYpXnViRJIwxHbA== Age: 68203 Vary: Origin
2024-01-15 23:16:11 UTC	853	IN	Data Raw: 2e 63 37 37 39 36 33 36 65 65 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 20 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 7d 2e 66 66 37 35 33 37 36 66 32 33 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e Data Ascii: .c779636eef{background-color:var(--bui_color_brand_primary_background);border-radius:var(--bui_spacing_2x);margin:var(--bui_spacing_6x) 0;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.ff75376f23{display:flex;margin:var(--bui_spacin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49739	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	617	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1298 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: ikngPEHuRB._VJ3nB71IwCpy_ZY.n4TG Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:10 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 0ClLffHBLvuu1r1seFO7Vs4dzIr5nNQ11E4-PdFgo0yjcSUNrsNbYw== Age: 254 Vary: Origin
2024-01-15 23:16:10 UTC	1298	IN	Data Raw: 2e 65 33 65 35 34 30 36 37 65 38 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 29 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 63 61 6c 63 28 31 35 31 70 78 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 29 7d 2e 65 33 65 35 34 30 36 37 65 38 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 Data Ascii: .e3e54067e8{position:relative;background-color:var(--bui_color_brand_genius_primary_background);color:var(--bui_color_foreground_inverted);padding-right:calc(151px - var(--bui_spacing_8x))}.e3e54067e8:before{content:"";position:absolute;top:0;left:0;z-ind

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49740	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:10 UTC	595	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 314 Connection: close Date: Mon, 15 Jan 2024 04:19:28 GMT Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HFw3ZCRRGpO5Si5sk_Tu_yxdqq5JBka Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: P8psP-aHW6PJLgN8PCiSPVRGLZlNReRK5xOaNGlN8D8cXYMI73XYzw== Age: 68203 Vary: Origin
2024-01-15 23:16:10 UTC	314	IN	Data Raw: 2e 62 32 63 61 39 37 35 36 37 30 7b 6d 61 72 67 69 6e 3a 30 7d 2e 66 61 65 31 34 30 30 62 65 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 61 34 31 38 37 31 63 65 33 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 65 65 35 37 34 62 33 34 66 61 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 69 73 74 61 74 69 63 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 74 65 72 6e 61 Data Ascii: .b2ca975670{margin:0}.fae1400be2{font-size:14px}.a41871ce38{margin-top:var(--bui_spacing_2x);padding:var(--bui_spacing_4x);padding-top:0;width:100%;box-sizing:border-box}.ee574b34fa{font-weight:700}/*# sourceMappingURL=https://istatic.booking.com/interna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49741	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4344 Connection: close Last-Modified: Thu, 11 Jan 2024 16:40:38 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: j3vRUKh3N5wQRjpo.YLWX0E6d_MTpX4K Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:12 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Lkyex_AK1kyNh2P5avPFPGoscHYpSI6x0DXEPk_8xO2WVhVXolaRoA== Vary: Origin
2024-01-15 23:16:11 UTC	3198	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 67 6e 73 76 5f 62 72 61 6e 64 2d 73 65 63 6f 6e 64 61 72 79 2d 63 6f 6c 6f 72 5f 77 65 62 3a 23 66 65 62 62 30 32 3b 2d 2d 67 6e 73 76 5f 6c 70 2d 63 61 6d 70 61 69 67 6e 2d 63 61 72 64 2d 68 65 69 67 68 74 5f 6d 64 6f 74 3a 31 37 36 70 78 3b 2d 2d 67 6e 73 76 5f 6c 70 2d 63 61 6d 70 61 69 67 6e 2d 63 61 72 64 2d 68 65 69 67 68 74 5f 77 77 77 3a 32 30 38 70 78 7d 2e 66 34 32 30 66 36 62 62 66 32 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 66 34 32 30 66 36 62 62 66 32 2c 2e 66 34 32 30 66 36 62 62 66 32 3a 6f 6e 6c 79 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 65 65 61 35 31 33 66 66 66 30 7b 64 69 73 Data Ascii: :root{--gnsv_brand-secondary-color_web:#febb02;--gnsv_lp-campaign-card-height_mdot:176px;--gnsv_lp-campaign-card-height_www:208px}.f420f6bbf2:last-child{margin-bottom:0}.f420f6bbf2,.f420f6bbf2:only-child{margin-bottom:var(--bui_spacing_1x)}.eea513fff0{dis
2024-01-15 23:16:11 UTC	1146	IN	Data Raw: 72 6f 75 6e 64 29 7d 2e 62 38 66 30 61 62 35 31 34 30 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 65 65 64 39 61 37 35 61 35 62 20 2e 62 38 66 30 61 62 35 31 34 30 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 29 7d 2e 66 64 35 36 30 36 33 64 34 38 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 7d 2e 65 65 64 39 61 37 35 61 35 62 20 2e 66 64 35 36 30 36 33 64 34 38 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 29 7d 2e 65 31 63 34 36 34 32 33 33 31 7b 64 69 73 70 6c Data Ascii: round)}.b8f0ab5140{color:var(--bui_color_foreground_alt)}.eed9a75a5b .b8f0ab5140{color:var(--bui_color_background_base)}.fd56063d48{color:var(--bui_color_foreground_disabled)}.eed9a75a5b .fd56063d48{color:var(--bui_color_background_base)}.e1c4642331{displ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49742	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 374 Connection: close Last-Modified: Fri, 12 Jan 2024 16:03:23 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: O9YXjCoflaDjBS.gn4EOkBZk6XYrQY.K Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 19:23:47 GMT ETag: "f1d67c93f1232808b430d12e5d784b19" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: FY2H-SBDgUoQZj_hwgyL5HkiPK85rpN8OX8q9Y0Ko0F4JmShvQZY5Q== Age: 13945 Vary: Origin
2024-01-15 23:16:11 UTC	374	IN	Data Raw: 2e 66 63 32 66 32 63 30 64 61 38 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 64 38 34 30 35 34 31 62 61 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 61 65 39 35 33 36 62 65 35 64 7b 6d 61 78 2d 77 69 64 74 68 3a 39 31 38 70 78 7d 2e 66 35 32 32 61 38 64 34 34 62 7b 70 61 64 64 69 6e 67 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 29 7d 2e 64 63 36 32 35 34 34 34 65 66 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 Data Ascii: .fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49743	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:10 UTC	575	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 3930 Connection: close Date: Mon, 15 Jan 2024 07:57:19 GMT Last-Modified: Mon, 15 Jan 2024 05:18:08 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XfMuq.rXaESBqMTX7ruwS5oLJVLV6ApO Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Cu0ETLRSBgrsgJkNhUxkfaOw_-SyedtI8wamqujAC7fp5J5aiKyK8g== Age: 55133 Vary: Origin
2024-01-15 23:16:11 UTC	3930	IN	Data Raw: 2e 62 34 65 33 39 61 62 32 61 62 7b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 62 34 65 33 39 61 62 32 61 62 2e 61 61 33 36 31 61 37 64 32 33 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 62 34 65 33 39 61 62 32 61 62 2e 63 36 38 66 31 33 30 62 65 31 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 62 65 32 30 33 31 35 30 31 66 7b 6d 61 78 2d 77 69 64 74 68 3a 31 31 31 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 37 35 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 Data Ascii: .b4e39ab2ab{width:100%;position:relative}.b4e39ab2ab.aa361a7d23{background:var(--bui_color_brand_primary_background)}.b4e39ab2ab.c68f130be1{background:var(--bui_color_white)}.be2031501f{max-width:1110px;min-height:375px;margin:0 auto;box-sizing:border-box

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49744	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2065 Connection: close Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: D2sB3v.J8RAANi6LFfApYSe1CMNLZpdq Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:12 GMT ETag: "e66324ef6e0246820fb69426fdb7b8ad" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 3bDbfdPY59sQJlHhhgGniQMgLx5lf8qtaJd8iW_W5R85zPtf3yP4wQ== Vary: Origin
2024-01-15 23:16:11 UTC	2065	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49746	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1713 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:04 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnwz09hvtwknIcM2kF_S.vczkTcR16kC Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:12 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: uOTdvApCLp9KuiOxDzFpyK2MWRmgbJbtMolO9Q6TxVKjDr8jUVGh-g== Vary: Origin
2024-01-15 23:16:11 UTC	1713	IN	Data Raw: 2e 63 31 66 34 65 66 34 64 38 33 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 38 64 31 66 33 39 38 34 35 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 66 37 34 32 61 31 30 30 66 30 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 64 35 33 37 36 37 37 32 65 62 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 38 37 62 65 38 32 36 38 62 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f Data Ascii: .c1f4ef4d83{margin-top:var(--bui_spacing_1x);margin-bottom:var(--bui_spacing_2x)}.a8d1f39845{margin-bottom:var(--bui_spacing_4x)}.f742a100f0{margin-bottom:var(--bui_spacing_3x)}.d5376772eb{margin-bottom:var(--bui_spacing_2x)}.a87be8268b{text-decoration:no

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49745	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	451	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:48:06 GMT Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" X-Cache: Hit from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: j93yAOsNFb5wnqHYSOyGXk1fwNL26XvGZK42YuTIQhl8ArH2gwss2w== Age: 2111285
2024-01-15 23:16:11 UTC	16384	IN	Data Raw: 39 39 61 30 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 99a0PNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-01-15 23:16:11 UTC	16384	IN	Data Raw: db 74 3d 9d c7 84 9c d2 3a e1 d6 44 9b 7f 6b ee 3c 99 b1 c3 46 89 db 6c b4 6e bf 5d 9e 53 7e e6 9b cf e3 84 e0 1c 8f 82 1e 95 7b 88 0a f6 28 cf 88 2f da 68 a5 80 6c cf 11 7a ef e9 69 54 b8 df 21 05 86 f7 c5 c2 f1 e8 7b 63 dd ca 3d ff d5 2c 8a dd 62 a3 c8 42 2b 0d 8e ad a0 99 19 35 f4 c5 a0 a5 1e 05 3d b4 a0 96 7a 44 1c a1 48 f9 6a 5e 1b 4d 8d de e2 51 d0 c7 2f 2e a2 04 f1 9d 58 a0 37 89 7d af 2a 35 d2 9f 3c 9c e7 6e 83 17 c9 63 8b 17 65 f9 bb 24 6e b3 d3 b3 5f cc 74 2b f7 cf 37 86 d3 92 4d 36 da 7e 94 5f 8d 6a 97 6d f9 3d a7 67 ba 95 e3 6b 34 32 bf 5c be 89 90 85 71 9d f8 fe cb 8b ec 14 2f 8e b5 e4 a8 43 9e d7 62 31 e5 75 7c 6c 9b e5 ef e2 90 1d 57 b7 1e b2 d3 5d 2f 0e 70 cf 60 fc 32 4f 9e 1b 76 3a f8 85 49 7c 7e b8 c3 a3 5b 06 e3 a9 3e 72 78 65 5e cf c3 Data Ascii: t=:Dk<Fln]S~{(/hlziT!{c=,bB+5=zDHj^MQ/.X7}*5<nce$n_t+7M6~_jm=gk42\q/Cb1u\|lW]/p`2Ov:I\|~[>rxe^
2024-01-15 23:16:11 UTC	6568	IN	Data Raw: f5 53 ab 62 59 3f 35 b5 ea c3 5d 36 5e a9 5f f4 ff 50 29 d6 aa 33 68 63 ed 97 53 77 df f5 f0 80 8d 2f 3c 3b 6a 47 ab 06 71 bb 3a d7 8e d9 de 57 9d 37 44 00 00 19 5b 49 44 41 54 eb a5 a4 7d 09 b5 07 6e fc fc ae 9e f9 0b 1a 8e d8 be e3 de 5e f9 9b 54 a4 07 1e e8 53 78 b4 5e cc c6 a3 0d 86 6f f5 3f 16 bb 39 00 11 43 b8 f5 06 d9 28 19 72 85 70 3d c9 de db 13 51 72 a1 39 06 a1 42 fe 90 b2 de 47 fe a3 e7 40 de 88 c2 21 75 ec 47 1f 02 d3 b1 4c 65 fe 90 6e df df d7 8a 1b d7 35 4a d8 a9 b2 ce 95 ba 7a 2e ae c5 b4 98 77 f5 c0 13 9d f2 4c d4 8e eb 71 1e ae f7 a2 f0 3b ba e5 05 a3 f2 db 9c e8 bd de dd e1 52 af 19 9d 73 4c 2f ef 9a 9d 73 8d e0 6f eb 50 20 35 db 17 9a e8 1d 13 7a 20 ca 3d 1b 33 76 9d ea 83 2d 50 ae 7f 7f b1 fc ba d1 54 b9 ea b1 54 95 6d 42 50 bc 97 3d Data Ascii: SbY?5]6^_P)3hcSw/<;jGq:W7D[IDAT}n^TSx^o?9C(rp=Qr9BG@!uGLen5Jz.wLq;RsL/soP 5z =3v-PTTmBP=
2024-01-15 23:16:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49747	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 3186 Connection: close Last-Modified: Fri, 12 Jan 2024 16:03:23 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: i8VIOxJV2yFa5BUWhskV1.j7HWicL3ff Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:12 GMT ETag: "c4aa6cc0b7d7b70cd0b7409f2336e955" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 65515d7b1028cd133489fb761d35fa06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: VTeWBrVWPjNfrnUrPm8qvDwIOnIp7joZIXHbSyds-PMO4VxxpSCU6g== Vary: Origin
2024-01-15 23:16:11 UTC	3186	IN	Data Raw: 2e 63 30 34 30 38 63 31 38 34 33 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 73 6b 2d 69 6d 61 67 65 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 6d 61 73 6b 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 23 66 66 66 2c 23 30 30 30 29 7d 2e 63 30 34 30 38 63 31 38 34 33 20 2e 66 38 37 37 37 32 62 62 37 34 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 35 73 20 65 61 73 65 2d 6f 75 74 7d Data Ascii: .c0408c1843{display:flex;flex-direction:column;height:100%;border-radius:var(--bui_border_radius_200);overflow:hidden;mask-image:none;-webkit-mask-image:-webkit-radial-gradient(#fff,#000)}.c0408c1843 .f87772bb74{opacity:0;transition:opacity .15s ease-out}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49748	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	620	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 15477 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:04 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnArrg..MyhLONitGPttToVO8CuhdWrQ Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 04:19:28 GMT ETag: "4066f4e0b6c463342177866cfb14bcfe" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 7W3pfx7Ksj5-PdGFPcpegorx2iphs3WdFndr0lB0rS7jqmwOK8mPSw== Age: 68204 Vary: Origin
2024-01-15 23:16:11 UTC	15477	IN	Data Raw: 2e 63 39 61 37 37 39 30 63 33 31 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 62 75 69 5f 73 68 61 64 6f 77 5f 31 30 30 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 32 32 62 37 38 32 35 32 31 7b 62 6f 78 2d 73 69 7a Data Ascii: .c9a7790c31{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x);margin:var(--bui_spacing_6x) 0 var(--bui_spacing_4x)}.e22b782521{box-siz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49749	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5793 Connection: close Date: Mon, 15 Jan 2024 04:19:28 GMT Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT ETag: "1fe97ff079513bb667876c67c4aa952f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: fCN4NuuMwamSymkc1hBoNY2dedXX15Np Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: oKZEK8YQnrhBFs6hquIqRxh5iGEfkkQL79Oeu-S7XCw4PyUs-dgjlg== Age: 68204 Vary: Origin
2024-01-15 23:16:11 UTC	5793	IN	Data Raw: 2e 62 38 32 35 32 38 63 39 31 37 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 61 66 34 63 31 36 34 33 34 35 2c 2e 63 31 61 33 36 65 39 33 33 63 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 63 39 34 33 63 63 30 35 36 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 31 31 62 61 66 61 64 38 36 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 31 31 62 61 66 61 64 38 36 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 Data Ascii: .b82528c917{flex:1;display:flex;flex-direction:column;justify-content:center}.af4c164345,.c1a36e933c{margin-bottom:var(--bui_spacing_1x)}.c943cc056e{margin-top:var(--bui_spacing_4x)}.e11bafad86{margin-right:var(--bui_spacing_4x)}.e11bafad86:last-child{mar

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49750	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:12 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2065 Connection: close Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: P_OeO7_9wdvhrPWHpPbMGYZNKf.mJTLR Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:13 GMT ETag: "9f91bb862449cb9e9205f6f0a89b9eca" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 4b5XPJqJmodOAIdDaiuZE17sq9jm7TC2rHBr46m7JjsjMzutQMqXBg== Vary: Origin
2024-01-15 23:16:12 UTC	2065	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49751	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:11 UTC	617	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1198 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:04 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: I7cO3m84_erQCMX4pKqVx53B33k62NS9 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:11 GMT ETag: "f820477c322829e348f318a453e432a5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 dc81af6f14945ade0fd126a735f82ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: xMEDgDdG68RdoRQf1zybCZ5AFohlCjGDOlL_OriQfEPz4kTwnQajAA== Age: 255 Vary: Origin
2024-01-15 23:16:11 UTC	1198	IN	Data Raw: 2e 61 38 37 62 65 38 32 36 38 62 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 7d 2e 61 38 37 62 65 38 32 36 38 62 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 62 30 62 63 66 66 62 35 64 63 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 7d 2e 63 33 61 34 64 33 33 36 39 66 7b 6d 61 72 67 69 6e Data Ascii: .a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49752	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	575	OUT	GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:12 UTC	614	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2479 Connection: close Last-Modified: Sun, 14 Jan 2024 05:17:32 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: AF8WYSv.TTFKcGPmsVIu8WqOuiX_TpgG Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:13 GMT ETag: "f22efe190d4cdfd20e43049d1c12a165" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 51Qq2-RiRUZtWODT5TRaeO79JQpWnvYkaIoEuks7BcI36giAfvQtNQ== Vary: Origin
2024-01-15 23:16:12 UTC	2479	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49753	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:11 UTC	579	OUT	GET /libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:12 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10673 Connection: close Server: nginx Date: Thu, 11 Jan 2024 14:09:53 GMT Last-Modified: Tue, 12 Dec 2023 09:10:15 GMT Expires: Sat, 10 Feb 2024 14:09:53 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "65782377-29b1" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 02LDIDaZ3tOvxFn4-IAC5A_aPpl-IXKAdSVNxaAfcDGnWYXmWgOf2g== Age: 378379
2024-01-15 23:16:12 UTC	9594	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 65 2c 63 3d 21 31 2c 70 3d 7b 61 6e 61 6c 79 74 69 63 61 6c 3a 22 43 30 30 30 32 25 33 41 31 22 2c 6d 61 72 6b 65 74 69 6e 67 3a 22 43 30 30 30 34 25 33 41 31 22 7d 2c 69 3d 22 25 32 43 22 2c 61 3d 22 62 6b 6e 67 5f 77 76 70 63 22 2c 74 3d 28 2d 31 3c 28 6e 3d 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3f 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3a 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 2f 22 29 3f 6e 2e 73 70 6c 69 74 28 22 2f 22 29 5b 32 5d 3a 6e 2e 73 70 6c 69 74 28 22 2f 22 29 5b 30 5d 29 2e 73 70 6c 69 74 28 22 3a 22 29 5b 30 5d 2e 73 70 6c 69 74 28 22 3f 22 29 5b 30 5d 2c 6f 3d 2f 62 6f 6f 6b 69 6e 67 5c 2e 63 6e 2f 2e 74 65 73 74 28 6c 6f 63 61 74 69 Data Ascii: !function(){var n,e,c=!1,p={analytical:"C0002%3A1",marketing:"C0004%3A1"},i="%2C",a="bkng_wvpc",t=(-1<(n=window&&window.location?window.location.href:"").indexOf("/")?n.split("/")[2]:n.split("/")[0]).split(":")[0].split("?")[0],o=/booking\.cn/.test(locati
2024-01-15 23:16:12 UTC	1079	IN	Data Raw: 6f 6e 73 65 6e 74 22 29 2c 69 3d 6b 28 6f 29 2c 61 3d 2d 31 3c 69 2e 67 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 70 2e 61 6e 61 6c 79 74 69 63 61 6c 29 3f 31 3a 30 2c 72 3d 2d 31 3c 69 2e 67 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 70 2e 6d 61 72 6b 65 74 69 6e 67 29 3f 31 3a 30 3b 79 28 6f 2c 74 29 2c 77 7c 7c 50 28 7b 61 6e 61 6c 79 74 69 63 61 6c 3a 61 2c 6d 61 72 6b 65 74 69 6e 67 3a 72 7d 2c 53 2e 62 69 6e 64 28 74 68 69 73 2c 69 2c 74 29 2c 7b 77 72 61 70 70 65 72 43 61 6c 6c 65 64 41 74 3a 65 2c 63 6f 6e 73 65 6e 74 65 64 41 6c 6c 3a 22 62 61 6e 6e 65 72 5f 61 63 63 65 70 74 5f 63 6f 6f 6b 69 65 73 22 3d 3d 3d 6e 7d 29 7d 7d 2c 77 69 6e 64 6f 77 2e 50 43 4d 29 2c 76 6f 69 64 20 30 3d 3d 3d 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 26 26 28 Data Ascii: onsent"),i=k(o),a=-1<i.groups.indexOf(p.analytical)?1:0,r=-1<i.groups.indexOf(p.marketing)?1:0;y(o,t),w\|\|P({analytical:a,marketing:r},S.bind(this,i,t),{wrapperCalledAt:e,consentedAll:"banner_accept_cookies"===n})}},window.PCM),void 0===window.dataLayer&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49754	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:12 UTC	685	OUT	GET /xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b68fe5777bddce07972ac30ae28ab8b8f2&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:12 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:26:53 GMT ETag: "1f14817c780d1c1b251591b8136e75e4c103f32f" Content-Language: 28618 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 87LJaNWuPDABQk4VumnspCPbG7c0AwtUArHlaCpEZsXDnIxKDOu2-w== Age: 2112559
2024-01-15 23:16:12 UTC	15998	IN	Data Raw: 33 65 37 36 0d 0a 52 49 46 46 c2 6f 00 00 57 45 42 50 56 50 38 20 b6 6f 00 00 d0 d8 01 9d 01 2a 1c 02 95 01 3e 6d 32 94 47 a6 24 22 a1 a6 55 fb 60 c0 0d 89 65 6d c4 b9 39 23 77 a6 80 2d 00 41 8a 22 49 50 cb 20 81 4e 7b 46 f6 f5 d5 78 c1 dc 93 22 94 57 da 75 d0 be 2b ea cd 6b f5 c7 de c4 95 f2 6f 95 3f 5a 97 4f 2f 79 db f5 07 9b 3f fb 7e c8 f0 71 bf 6f 75 b7 79 fa 2f 95 66 2d e7 3d 7c f9 7c f8 df f1 1e df 5f 9e 67 7f e4 7f bc f3 43 ec e7 f4 ff c7 7b 60 fe ef c0 bf 9a 7a 8b fb a3 c2 57 77 b7 03 fe d3 d0 9b e1 3f c5 79 ea 7d 8f ed 67 ad 7f 66 3d 81 3f 5c 7d 3a ff a5 e3 39 f8 1f f7 df b7 7f 01 3f d6 bf c5 7f f2 f6 84 ff 2b ff d7 a1 cf d9 7f da f4 f2 7b 5b fd af ff ff eb 4a 48 e0 a5 fa 8e 6e 34 a6 cb b0 76 17 00 48 cf 22 61 66 f8 d2 d2 65 6d 76 5e 7e bc b5 3a Data Ascii: 3e76RIFFoWEBPVP8 o*>m2G$"U`em9#w-A"IP N{Fx"Wu+ko?ZO/y?~qouy/f-=\|\|_gC{`zWw?y}gf=?\}:9?+{[JHn4vH"afemv^~:
2024-01-15 23:16:12 UTC	12636	IN	Data Raw: 33 31 35 34 0d 0a a6 ed 30 b9 fe 75 20 71 04 9a fe d0 86 33 dc a6 95 61 ae 3f 3f 35 3b f7 3f 4e bc 6b 02 4f 97 19 cc e5 24 63 25 11 f1 b0 3b 84 98 74 83 69 70 d3 8b cb 68 ce 02 92 0b fb e7 eb bf 71 60 6e 1a 27 a7 76 c4 44 e0 e1 0c 2f a4 ca fd fc fb c8 c8 02 24 2d 3a 0f d2 9e 7b 9a 85 7e 41 29 ea c8 a1 41 ba e6 1c 84 49 75 6f ca 36 2e 20 c1 ad a6 9a 35 2c e7 db 4e 12 50 2d 7e 6b 97 c8 17 0b be 37 41 98 2e 00 c0 6e 9a 8d 3c 10 c3 e7 f6 75 fc 09 4a 3a 12 d2 97 76 65 a9 56 34 ae 13 f9 03 8e ac 03 d9 7b 95 6a 81 a2 d8 9c fa 61 8b 1b e1 46 b8 5c 0c e1 5c 52 67 2c f5 fd c5 0e a9 e8 9c 30 4a d1 8a 29 ba 39 9d 94 5a d8 23 fb 52 bd 37 e8 01 d0 26 45 c0 78 d6 af 86 3f da 64 d7 1f 1b 51 9b ed 7b 9d a2 6c ab 06 ff e9 29 07 37 0c 18 63 a1 da e5 d9 c4 c3 c6 bf 29 af 60 Data Ascii: 31540u q3a??5;?NkO$c%;tiphq`n'vD/$-:{~A)AIuo6. 5,NP-~k7A.n<uJ:veV4{jaF\\Rg,0J)9Z#R7&Ex?dQ{l)7c)`
2024-01-15 23:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49755	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:12 UTC	685	OUT	GET /xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22ddb81a8d5ed73135330e426f8d2b9629&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:12 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 01 Jan 2024 08:45:30 GMT ETag: "295b294e3a0689b395787df4e43c129bf4669e6d" Content-Language: 31670 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: fyuw0YWLKhG9ELoPgq1p5SP0WSfPWqcuWSgaVPE9A0gzh2qXvaGwkA== Age: 1261842
2024-01-15 23:16:12 UTC	15834	IN	Data Raw: 37 62 62 36 0d 0a 52 49 46 46 ae 7b 00 00 57 45 42 50 56 50 38 20 a2 7b 00 00 f0 f8 01 9d 01 2a 1c 02 95 01 3e 6d 30 94 47 26 24 22 a1 a8 13 1c 78 c0 0d 89 63 07 08 6a cb 24 e1 0f b9 b4 f3 36 5d cd 78 1e 58 fc 9f e3 8c 75 bf bf e1 f7 cf 7f e1 f3 80 f6 8e f4 bf f4 7d 77 7e b3 f5 71 e9 9f ce cd bb 1b eb bb a7 81 7f bf e6 ff d2 7f c7 f0 97 ce 17 cf 3f 89 f6 ac fd 83 24 ff 03 fe 4f ed 47 a9 7f 73 b3 c7 fd 7f 7f 3f 32 bf e6 ff 39 ec 29 f9 af f5 5f f9 bf e0 3d 91 ff 33 b8 13 8b ff 89 e8 3b ef 97 df 3c f1 7f 4f cf 5f e2 7d 42 7c d0 ff cd e3 b7 ea 3e c3 5f a8 bd 23 75 07 fb 17 fc 02 a3 b3 bf da 84 a6 7f f2 64 0e 19 79 a0 bd e1 1d 9c 30 c7 34 aa 3f d6 13 b5 c1 cd 34 31 49 88 3e 18 61 86 18 61 86 18 61 86 18 61 86 18 61 85 e8 e4 d5 c2 af 41 74 bc ff 64 dc bc ff a3 Data Ascii: 7bb6RIFF{WEBPVP8 {*>m0G&$"xcj$6]xXu}w~q?$OGs?29)_=3;<O_}B\|>_#udy04?41I>aaaaaAtd
2024-01-15 23:16:12 UTC	15844	IN	Data Raw: dc 8f 31 b3 b8 fa 6f df 31 8e d9 6c 00 c6 3c 1a 5e 67 00 1a 95 53 10 cd 79 fa a1 68 b8 80 34 e8 cc 46 f4 2a 95 b3 ed 02 79 ec 5d 64 2b 1a 17 25 28 04 bc 28 ca f4 35 e9 76 c0 66 6f 18 4f a2 48 6f d9 7c 67 b5 8b 1d 9d f8 d3 66 60 9b 72 bb c4 8a 40 10 c2 d0 7b 8a f9 44 17 d6 95 b5 0b a6 60 10 8b 67 b6 b7 63 e5 98 6e 17 f5 34 a9 2c e0 39 ac 6c 85 9b 30 4c ca 1b e0 44 7d 9d 13 cf 75 c1 24 2a 37 88 14 55 57 d3 c0 32 d8 5b 0c 45 93 29 12 95 31 91 35 a7 9b 7b 28 26 06 84 08 90 22 7f 0f 55 63 62 4d e5 6a 1d cf 85 10 78 02 42 2d 8d 11 29 7a 90 dd a6 54 4c e9 a4 26 46 a7 a0 6e ef 26 cc cd 03 c3 ca f0 8d dd bc cd 53 46 c7 e6 32 aa 66 82 47 57 9c 88 b5 59 ef e5 e0 fb ab 8a 3d ef 40 e1 61 89 16 84 3a b2 00 e9 96 d8 0b 22 4e f5 ee ad 83 5f e4 ab 8c 07 12 00 cf 10 f4 d2 Data Ascii: 1o1l<^gSyh4Fy]d+%((5vfoOHo\|gf`r@{D`gcn4,9l0LD}u$7UW2[E)15{(&"UcbMjxB-)zTL&Fn&SF2fGWY=@a:"N_
2024-01-15 23:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49756	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:15 UTC	685	OUT	GET /xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e0b261f88de846c23d3bf5693de202238&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:15 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 30 Dec 2023 20:37:36 GMT ETag: "fade909831cdda8e557d517b4aec62b3721f38e5" Content-Language: 47044 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vK01zE16aNeFVSO3S4TpxaQZWHiBgkLnAv5USTt6DbUWOAvNl8iOAg== Age: 1391919
2024-01-15 23:16:15 UTC	15834	IN	Data Raw: 61 65 64 36 0d 0a 52 49 46 46 bc b7 00 00 57 45 42 50 56 50 38 20 b0 b7 00 00 10 79 02 9d 01 2a 1c 02 95 01 3e 6d 2e 92 46 a6 23 a2 a1 aa b3 3d 80 c0 0d 89 63 6c 8d c8 ae 2b d9 10 21 e1 35 a1 dc d9 f5 2b f6 48 78 5e 8f 69 e5 b7 cc be 4a 46 a7 fd 3e 10 7b f7 98 3f b3 f7 60 f6 23 cb b5 b7 bd a9 c1 d0 bb 79 df 28 fe 60 fe 8b fc 37 ed b7 9b 3e 3f bd d1 fb 9f f9 ef fb 1f e1 fe 64 7f 1b ff a7 fc ff 8c ef 7c fe 9f f6 ef d4 7f e7 ff 8e bf 9b fe 3b da 57 f4 1f f9 bf cf f8 e7 f2 0b fd ef f2 3f e9 7d c3 bf 32 fe 97 fe df fb bf ac 27 dc fe de f8 49 ed df eb ff 6d 7d 85 fd da fb bf fe 3f f2 5e ad 7f 71 e7 87 da 6f 60 af ea 9f de bd 49 ff b5 e2 e5 ea 5e c1 bf ab bd 5c bf ca ff f5 ff 1f d4 e7 eb 5f ed bf 6d 7e 09 ff 64 fd 38 80 e7 0d ee c5 71 05 65 f8 d8 65 5d 44 49 e9 Data Ascii: aed6RIFFWEBPVP8 y*>m.F#=cl+!5+Hx^iJF>{?`#y(`7>?d\|;W?}2'Im}?^qo`I^\_m~d8qee]DI
2024-01-15 23:16:15 UTC	16384	IN	Data Raw: 9c bf a7 f8 fe fe 08 70 0e 96 0e d2 c8 5e a9 58 55 88 c2 26 fd ad b8 0f 90 ad cb 4b cf a2 26 9f da 1d 95 c3 7f c8 0e 16 18 0e 5c 90 fe 09 7f 73 07 56 4b f0 e3 54 0b b7 4a e0 1f cf de 54 b8 15 28 2b 44 ca 3d 17 1f 24 6a 0d 55 6b d7 d8 ff 83 f1 dd 03 58 b6 b0 52 b9 0a c5 ee 74 28 8b 7b 1a 66 41 66 50 96 cc 92 50 38 a1 a3 45 c2 ce 6f 26 7a 37 13 39 fc 3f bf 04 6e 16 38 51 9a 81 ac 4d 55 fd 07 a4 38 d8 7f da d6 e9 6b 0a 7c 74 36 d0 31 6d 15 b4 af a5 0f da 17 d6 21 f8 ab 69 d6 95 fc f9 9e 35 87 2b 76 54 ea 50 72 ad 5e 4a 83 12 2e 70 16 77 c6 3a 75 ff c7 70 41 04 8c 3e a7 fd 40 0d a5 c0 6a 99 f3 70 f4 75 dc 56 f5 25 ef d6 99 87 98 68 c8 db 45 41 5c 22 b3 03 82 0f 3f 22 12 48 14 10 7f cb b9 60 96 c7 29 ce 6d f8 7f ff 89 d4 15 c9 42 51 e4 11 67 98 ae 62 2e 24 dd Data Ascii: p^XU&K&\sVKTJT(+D=$jUkXRt({fAfPP8Eo&z79?n8QMU8k\|t61m!i5+vTPr^J.pw:upA>@jpuV%hEA\"?"H`)mBQgb.$
2024-01-15 23:16:15 UTC	12548	IN	Data Raw: 0f a7 80 1d 7d 1a 9c 36 ab 32 36 87 f7 3a 42 0b 4c cb c1 ad f5 3a 52 ba da 28 6e 7c 49 47 50 76 68 3f ab 7a 8d 46 73 f4 ec 57 bd 99 ba bb 00 d1 05 cd b0 9e a7 53 f2 e3 8c 6b 73 0b a9 52 70 e6 76 89 19 10 c6 f1 a6 7e cb a8 e8 c5 cc ed 22 f2 8f d7 09 92 e7 75 e8 8d f7 95 e9 1b 84 ef 93 c1 32 ad 1f 21 70 c0 19 23 e9 7e d4 b6 c6 38 bb 2e 37 c8 9f a3 d8 1e 09 2f 75 20 11 c9 24 4d 3c c6 ab c0 a6 f1 1b 3c b6 c2 d6 2b cb 35 4e 46 0d d5 ca 08 bc 6d 0b 34 7a 29 7b 98 f7 b0 32 d8 d9 14 47 d9 ca 91 f9 a1 1b 35 36 35 88 2d 6b 1e 0f d2 9f 17 7b a1 15 76 66 40 59 55 1c 73 a4 b7 4c ce fb 5b b1 27 dc d2 5d 60 81 6e ce ed e7 a2 d9 39 d9 9d 10 4e a6 54 06 89 cb 61 80 5e a9 5f bb 91 bf 1d 49 26 23 9e 2f a1 9c 53 9e 17 54 89 c2 93 a6 5d c5 bd 81 6f ae 5e e1 a3 0a 1f 39 79 07 Data Ascii: }626:BL:R(n\|IGPvh?zFsWSksRpv~"u2!p#~8.7/u $M<<+5NFm4z){2G565-k{vf@YUsL[']`n9NTa^_I&#/ST]o^9y
2024-01-15 23:16:15 UTC	2293	IN	Data Raw: 38 65 65 0d 0a b1 7d 76 f2 e3 cd f7 02 82 1c 12 7d d3 5b 93 70 67 2b af 03 ec 06 5e 03 70 ba bf 82 0c 5e bd d7 b3 91 e0 50 86 d2 53 97 80 18 13 09 02 2f b9 23 83 d3 15 2d a8 f9 d0 f3 ca 73 93 e0 9a a0 1f 28 1c 82 b7 be fc c3 4c 51 1f 5a f7 be d5 90 17 08 17 8a 48 a6 b0 f4 69 98 b4 1f d6 7c c9 a5 14 9f ce c2 7b 9d 9c 3e 34 ab 3f 67 81 f8 9a 1a d9 9f 71 0e 33 af 6b da d1 9a 9d a5 0b 23 0a ba f0 a3 37 9b cc 31 00 29 df 94 6f 76 0e 75 25 85 14 b8 5e cb 84 3b 64 fc b4 bd 18 16 af 4a ad 9e 3c 45 2b b4 d2 08 1e e6 8b cd 4d 2e 04 b3 10 c7 de 02 70 ff c3 fe 68 27 c1 d2 34 85 34 00 b9 ad 73 7b 0f 72 c6 a0 db 61 9c b1 0b 90 c0 8b 03 0c 37 b7 fa 73 25 55 1f 7c 61 5f e8 c1 51 26 b5 67 d4 54 40 b0 6f 82 5e 0e 74 5a 9f ab c2 5b ec 8a 8c 38 53 cc e2 ba 9f 4b da a3 5c e0 Data Ascii: 8ee}v}[pg+^p^PS/#-s(LQZHi\|{>4?gq3k#71)ovu%^;dJ<E+M.ph'44s{ra7s%U\|a_Q&gT@o^tZ[8SK\
2024-01-15 23:16:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49759	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	621	OUT	GET /static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	806	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3448 Connection: close Server: nginx Date: Thu, 04 Jan 2024 07:47:35 GMT Last-Modified: Wed, 01 Nov 2023 08:40:16 GMT ETag: "65420ef0-d78" Expires: Sat, 03 Feb 2024 07:47:35 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: LHUss2hro2Dep72Fi-pFu-ifO6fKfAcKzm4dz9yc90q4CHwJaSCF_g== Age: 1006121
2024-01-15 23:16:16 UTC	3448	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 5f 7d 3b 42 2e 64 65 66 69 6e 65 28 22 77 69 74 68 2d 63 61 70 6c 61 22 2c 66 75 6e 63 74 69 6f 6e 28 5f 2c 69 2c 65 29 7b 5f 69 5f 28 22 65 64 64 3a 63 61 62 62 32 34 66 36 22 29 3b 76 61 72 20 6e 3d 5f 28 22 70 72 6f 6d 69 73 65 22 29 2c 74 3d 7b 7d 2c 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 28 5f 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 64 64 3a 34 64 33 35 30 35 39 33 22 29 2c 5f 72 5f 28 5f 2e 73 6c 69 63 65 28 30 2c 2d 38 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 69 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 64 64 3a 64 63 65 63 66 66 34 39 22 29 2c Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(_){return _};B.define("with-capla",function(_,i,e){_i_("edd:cabb24f6");var n=_("promise"),t={},r={};function d(_){return _i_("edd:4d350593"),_r_(_.slice(0,-8))}function a(i){return _i_("edd:dcecff49"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49758	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	621	OUT	GET /static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 9646 Connection: close Server: nginx Date: Tue, 26 Dec 2023 09:40:05 GMT Last-Modified: Thu, 19 May 2022 11:44:13 GMT ETag: "62862d8d-25ae" Expires: Thu, 25 Jan 2024 09:40:05 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 3ha3uWX2gxUlk6eXNKSoRuDlf1vRgCcp4aFeeszMKGSLSFmbW6ap7w== Age: 1776971
2024-01-15 23:16:16 UTC	9646	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 42 2e 64 65 66 69 6e 65 28 22 75 74 69 6c 73 2f 62 69 6e 64 2d 61 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 5f 69 5f 28 22 66 65 33 3a 63 61 32 30 64 35 36 32 22 29 2c 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 5f 69 5f 28 22 66 65 33 3a 66 65 37 32 33 37 31 31 22 29 2c 65 29 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 5b 74 5d 26 26 28 65 5b 74 5d 3d 65 5b 74 5d 2e 62 69 6e 64 28 65 29 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 65 29 7d 2c 5f 72 5f 28 29 7d 29 2c 42 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};B.define("utils/bind-all",function(e,t,n){_i_("fe3:ca20d562"),n.exports=function(e){for(var t in _i_("fe3:fe723711"),e)"function"==typeof e[t]&&(e[t]=e[t].bind(e));return _r_(e)},_r_()}),B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49766	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	2422	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone
2024-01-15 23:16:16 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:16 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=efbaa3a09eff0277&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL7D3jX0_k8z1sGmLoK3IPiagac9fXJptI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 1QMZrAvXco8OiJHPPtGuYnmrhRJkzkPOEH2R3arL9kwmttK7EpX24w==
2024-01-15 23:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49763	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	544	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:16 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: FWT01iLvZ++xUAz3aesSug== Last-Modified: Thu, 11 Jan 2024 20:28:17 GMT x-ms-request-id: 3bb69f20-501e-0032-6204-4539f4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 43592 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d3518b1d0650-IAD
2024-01-15 23:16:16 UTC	554	IN	Data Raw: 35 32 36 63 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 2c 6f 2c 70 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 Data Ascii: 526cvar OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIAB
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d 5d 22 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 44 6f 6d 61 69 6e 49 64 3d 22 5b 5b 4e 65 77 44 6f 6d 61 69 6e 49 64 5d 5d 22 2c 74 68 Data Ascii: HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",th
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 65 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 74 2c 65 5d 29 2c 22 73 74 79 6c 65 Data Ascii: his.camelize(a[0])]=a[1].trim()}return e},e);function e(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=function(t,e){if("style"!==t.toLowerCase()&&o.apply(this,[t,e]),"style
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 28 69 3d 73 2e 77 69 6e 29 3f Data Ascii: oveGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];var i=null==(i=s.win)?
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 28 69 3d 6e 29 26 26 69 2e 6c 61 73 74 49 64 7c 7c 28 6e 2e 6c 61 73 74 49 64 3d 30 29 2c 6e 2e 6c 61 73 74 49 64 2b 2b 2c 6e 2e 65 76 65 6e 74 73 2e 70 Data Ascii: name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],null!=(i=n)&&i.lastId\|\|(n.lastId=0),n.lastId++,n.events.p
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 Data Ascii: ce=function(){this.nonce=p.stubScriptElement.nonce\|\|p.stubScriptElement.getAttribute("nonce")\|\|null},h.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL(),this.crossOrigin=p.stubScriptElement.getAttribute("crossorigin")\|\|null,this.pr
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 69 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 69 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 28 69 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 74 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 Data Ascii: ponse,this.setGeoLocation(i.countryCode,i.stateCode),this.addBannerSDKScript(t)):(i=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam))\|\|t.SkipGeolocation?(e=i.split(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScri
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 65 29 7b 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 3d 7b 63 6f 75 6e 74 72 79 3a 74 2c 73 74 61 74 65 3a 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 2c 6e 2c 61 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f Data Ascii: e){p.userLocation={country:t,state:e=void 0===e?"":e}},h.prototype.otFetch=function(t,i,e,n,a){void 0===e&&(e=!1),void 0===n&&(n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.o
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 6f 6e 2c 6f 3d 74 2e 52 75 6c 65 53 65 74 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 74 2e 44 65 66 61 75 6c 74 7d 29 3b 69 66 28 21 61 2e 63 6f 75 6e 74 72 79 26 26 21 61 2e 73 74 61 74 65 29 72 65 74 75 72 6e 20 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 3f 6f 5b 30 5d 3a 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 6c 3d 74 2e 52 75 Data Ascii: on,o=t.RuleSet.filter(function(t){return!0===t.Default});if(!a.country&&!a.state)return o&&0<o.length?o[0]:null;for(var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var l=t.Ru
2024-01-15 23:16:16 UTC	1369	IN	Data Raw: 74 43 6f 6f 6b 69 65 28 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 29 29 3a 70 2e 69 73 53 74 75 62 52 65 61 64 79 3d 21 31 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 69 64 61 74 65 49 41 42 47 44 50 52 41 70 70 6c 69 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 3b 74 3f 74 68 69 73 2e 69 73 42 6f 6f 6c 65 61 6e 28 74 29 3f 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 22 74 72 75 65 22 3d 3d 3d 74 3a 70 2e 6f 6e 65 Data Ascii: tCookie(p.oneTrustIABCookieName)):p.isStubReady=!1},h.prototype.validateIABGDPRApplied=function(){var t=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam).split(";")[0];t?this.isBoolean(t)?p.oneTrustIABgdprAppliesGlobally="true"===t:p.one

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49757	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	679	OUT	GET /xdata/images/city/600x600/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:41:16 GMT ETag: "c2a0d68be0fd729b1f89d777aa710ab600246d6b" Content-Language: 58468 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: rAdiI5MUwqEdHG4crybozjaB_qddwMUp4bYH7m-KQkOtofiPNUWHog== Age: 1535700
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 65 34 36 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: e464JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 87 96 14 23 cc f3 81 db 9e 71 83 cd 26 52 33 64 82 77 f9 d5 09 c9 c8 20 f5 a8 c6 f8 d6 45 7c 83 8e 47 5a d0 66 92 38 46 d8 cb 90 00 c0 20 56 75 e6 1e 59 0e 4f e7 ed 54 43 43 4b 65 41 ce 72 6a c2 e0 93 9e c3 b6 2a 9c 67 f7 6b 9f ef 55 c0 41 03 d8 7b 52 1a d8 bb 9c 59 29 18 1f 38 e8 31 df da b9 f9 4e 27 90 f1 f7 bf ad 6c 31 ff 00 47 41 fe d5 62 48 e4 c9 27 07 ef 7f 5a 23 b8 4b 62 b9 b6 82 ee 1f 2e e2 18 a5 4c 8e 1d 73 de b2 b5 2f 87 da 7c f6 e2 4b 49 fe c9 23 e4 88 9c 6e 42 73 db d3 b5 6d da 10 66 5d e8 0a 60 92 0e 71 5a 72 5f a3 29 56 8a 23 80 0a e4 fe 1f d2 94 e0 99 50 9c 91 e2 9a 9f 86 ef f4 b6 6f b4 42 de 5a f4 91 06 e5 3f e1 58 ee 81 3f 84 fe 3c 66 bd fe 4b 98 98 e5 a0 b7 25 7a 09 1f eb db bd 73 3a b7 83 74 bd 49 de 5b 75 5b 49 58 06 3e 59 f9 33 81 d4 Data Ascii: #q&R3dw E\|GZf8F VuYOTCCKeArj*gkUA{RY)81N'l1GAbH'Z#Kb.Ls/\|KI#nBsmf]`qZr_)V#PoBZ?X?<fK%zs:tI[u[IX>Y3
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: ae f8 66 c6 f8 4c 25 73 18 49 48 04 7c e3 86 18 38 ee 0d 6d 02 a0 00 a0 03 d4 d3 10 e0 00 3d 70 7b f1 d6 a4 0e 07 05 79 1d f1 48 81 b0 1b 6f 1e e2 9f bf 68 e4 26 3e 98 a4 00 b3 21 c7 1d 7d ba 53 8c 87 9d a7 1f 4c 73 4c 12 a0 c8 0c 06 7d 4f 1f ce 90 ce aa 02 ef 50 4d 03 b9 21 9b 03 20 1f c1 73 48 67 ce 32 87 91 fd da 63 6e 03 be df 52 33 4b e6 80 40 59 47 b8 3d 68 b0 0a 66 5d c0 79 6b f9 0a 29 c6 43 90 30 79 ef fe 4d 14 01 f3 61 f1 35 e6 a3 23 09 25 6f 9d 95 33 9c 00 39 e9 e9 df a5 40 75 04 9a f0 46 c9 9d b1 aa aa 67 b9 27 a7 e7 9a c4 53 25 a5 d1 46 46 8d c3 8f 95 86 0a 9f 42 29 cd 39 82 fa 52 cd 82 24 20 f1 f5 ed f8 9a e4 b0 d4 75 3a e9 ef 22 7b e2 a8 14 45 6d 0a 79 84 29 00 00 3e ef 1d 09 3b ba f7 cd 53 5b eb 5b 8b 9b 89 66 21 61 3c aa 23 01 b7 d0 74 f4 Data Ascii: fL%sIH\|8m=p{yHoh&>!}SLsL}OPM! sHg2cnR3K@YG=hf]yk)C0yMa5#%o39@uFg'S%FFB)9R$ u:"{Emy)>;S[[f!a<#t
2024-01-15 23:16:16 UTC	9324	IN	Data Raw: 6f b9 24 27 78 55 1c 6d ff 00 3f ca af 1b 88 24 75 9b ee 4a 5b a0 27 93 d4 63 f4 a4 1a b1 b2 15 5f dd c3 91 20 6c 9c 91 9e fd 73 ed 56 a3 9d 63 8d 51 94 c8 c0 1d ca cb 80 69 ab 29 86 1d ca a8 f2 02 5a 46 74 eb cf 19 e3 9e bf a5 52 8e f0 ef dd bc 93 d3 18 e0 9c 9e 9f e7 b5 0c 1e 86 a0 bf 70 8b b9 1b 68 c2 8e 78 3c 1e ff 00 9d 22 cb 0a ae d8 e2 20 aa 92 e7 1d 07 f9 ed 54 d2 f3 7a 31 52 44 50 92 31 8c ef 24 fb d2 34 f1 f9 2e 08 5d ab 8c 67 81 ef f8 d1 7b 03 66 94 f7 7f bb 4c ee 48 c2 81 85 24 00 0f ff 00 ae aa dc de c7 0a f9 f9 24 1e 77 15 cf 6c 75 15 4e c6 e8 cf 14 6b 2c 43 e6 dc 03 67 01 47 a7 e9 56 27 9e cd ed 12 38 a6 29 26 e5 c9 c0 3c fa 62 9d ee 3e 6b 97 22 d5 e7 b8 88 40 64 44 72 08 c3 2e 47 b7 3e a6 a4 17 13 89 21 89 9c b6 79 6d a3 fa d4 10 59 25 b1 Data Ascii: o$'xUm?$uJ['c_ lsVcQi)ZFtRphx<" Tz1RDP1$4.]g{fLH$$wluNk,CgGV'8)&<b>k"@dDr.G>!ymY%
2024-01-15 23:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49764	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	627	OUT	GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	532	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 950 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:05 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:05:54 GMT ETag: "025b409525836b9e0913038b2556d2cf" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: KTHAUxd4xizxOiePC3tzV6J11jcgOUaPC4wdlt5bdNT7vN_R_HO_6Q== Age: 25823 Vary: Origin
2024-01-15 23:16:16 UTC	950	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 48 08 03 00 00 00 62 33 43 75 00 00 00 54 50 4c 54 45 19 2f 5d d1 77 7c cb 68 6d 3e 50 77 e0 a2 a6 d9 8d 91 21 37 63 ff ff ff bd 3d 44 c4 51 58 56 49 69 2b 3f 69 69 78 96 89 95 ac 59 68 8a 4a 5c 80 35 48 70 7a 87 a2 9d a6 ba e3 e6 ec d0 d5 de b0 b8 c8 bf c5 d2 32 31 59 d3 7d 82 e8 bd bf c9 62 67 f4 f5 f7 9d dd 5e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 08 49 44 41 54 78 9c ed 56 d9 72 dc 20 10 9c 04 07 d6 e1 3e 37 09 ff ff 9f 29 98 19 d9 96 8d 94 b8 f4 e4 da ae 7d e8 5a a1 d6 d0 f4 00 00 9f c2 fd b6 c7 fc 5b f3 f3 f7 04 e4 87 cf 16 42 89 47 db 40 24 7a 22 ce 10 09 96 85 ea 4a 48 37 95 e7 7b b2 aa ec 26 b1 bd 47 14 ec 1d 05 4c 56 75 7e 4e 14 55 c4 a2 22 Data Ascii: PNGIHDRHHb3CuTPLTE/]w\|hm>Pw!7c=DQXVIi+?iixYhJ\5Hpz21Y}bg^upHYsIDATxVr >7)}Z[BG@$z"JH7{&GLVu~NU"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49761	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	614	OUT	GET /static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 124312 Connection: close Server: nginx Date: Fri, 22 Dec 2023 10:10:06 GMT Last-Modified: Fri, 22 Sep 2023 15:01:10 GMT Expires: Sun, 21 Jan 2024 10:10:06 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "650dac36-1e598" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: r0qZyYli1XWhqZ9Iu8FBL4GP93EZ2foaH3A8vXSZhoex8WqYCUEFxw== Age: 2120770
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 72 61 66 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 2f 72 65 66 65 72 72 61 6c 2f 66 6c 6f 61 74 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 5f 69 5f 28 22 34 34 64 3a 34 33 39 63 62 37 64 64 22 29 3b 76 61 72 20 72 3d 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 22 29 2c 61 3d Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.raf={loaded:!0,run:!1}),B.define("component/referral/floater",function(e,n,i){_i_("44d:439cb7dd");var r=e("component"),a=
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 72 22 29 2b 22 3c 2f 61 3e 3c 2f 70 3e 22 2c 66 65 5f 73 65 6c 66 5f 72 65 66 65 72 72 61 6c 3a 21 21 73 2e 72 65 66 65 72 72 61 6c 5f 64 61 74 61 2e 66 65 5f 73 65 6c 66 5f 72 65 66 65 72 72 61 6c 2c 62 5f 73 69 74 65 5f 74 79 70 65 3a 73 2e 62 5f 73 69 74 65 5f 74 79 70 65 2c 66 65 5f 72 61 66 5f 64 65 73 6b 74 6f 70 5f 66 72 69 65 6e 64 5f 6c 61 6e 64 69 6e 67 5f 62 61 6e 6e 65 72 5f 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 3a 63 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 73 28 22 72 61 66 5f 64 65 73 6b 74 6f 70 5f 66 72 69 65 6e 64 5f 6c 61 6e 64 69 6e 67 5f 62 61 6e 6e 65 72 5f 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 22 2c 6e 75 6c 6c 2c 7b 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 3a 73 2e 72 65 66 65 72 72 61 6c 5f 64 61 74 61 2e 62 5f 72 61 66 5f 6d 69 6e 5f Data Ascii: r")+"</a></p>",fe_self_referral:!!s.referral_data.fe_self_referral,b_site_type:s.b_site_type,fe_raf_desktop_friend_landing_banner_minimum_spend:c.translations("raf_desktop_friend_landing_banner_minimum_spend",null,{minimum_spend:s.referral_data.b_raf_min_
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 5d 2c 28 65 2e 75 6e 73 68 69 66 74 28 7b 6e 61 6d 65 3a 5f 5b 31 32 5d 2c 73 69 7a 65 3a 5f 5b 31 33 5d 7d 29 2c 61 3d 72 2e 48 45 4c 50 45 52 28 22 69 63 6f 6e 22 2c 65 5b 30 5d 29 2c 65 2e 73 68 69 66 74 28 29 2c 61 29 2c 5f 5b 31 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 69 3d 5f 72 5f 28 6e 29 2c 69 2b 3d 5f 5b 31 35 5d 2c 5f 72 5f 28 69 29 7d 29 7d 28 29 29 2c 69 2e 65 78 70 6f 72 74 73 3d 72 2e 65 78 74 65 6e 64 28 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 34 64 3a 31 36 61 39 63 36 35 62 22 29 3b 76 61 72 20 65 3d 42 2e 6a 73 74 6d 70 6c 28 22 69 6e 76 61 6c 69 64 5f 6c 69 6e 6b 5f 63 61 72 64 22 29 2c 6e 3d 7b 62 5f 72 61 66 5f 6c 69 5f 69 6e 3a 74 68 69 73 2e 24 65 6c 2e 64 61 74 61 28 22 72 61 66 2d 6c 69 2d 69 6e 22 Data Ascii: ],(e.unshift({name:_[12],size:_[13]}),a=r.HELPER("icon",e[0]),e.shift(),a),_[14]].join("")),i=_r_(n),i+=_[15],_r_(i)})}()),i.exports=r.extend({init:function(){_i_("44d:16a9c65b");var e=B.jstmpl("invalid_link_card"),n={b_raf_li_in:this.$el.data("raf-li-in"
2024-01-15 23:16:16 UTC	11610	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 27 2c 27 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 5f 5f 74 65 78 74 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 67 72 6f 75 70 5f 5f 69 74 65 6d 22 3e Data Ascii: <a href="','" target="_blank" class="bui-button">\n <span class="bui-button__text">\n ',"\n </span>\n </a>\n ",'\n <div class="bui-group__item">
2024-01-15 23:16:16 UTC	3473	IN	Data Raw: 2d 75 2d 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 2d 2d 38 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 67 72 6f 75 70 5f 5f 69 74 65 6d 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 6e 3a 63 6c 69 63 6b 3d 22 6f 70 65 6e 4d 6f 64 61 6c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 62 75 69 2d 6c 69 6e 6b 20 62 75 69 2d 6c 69 6e 6b 2d 2d 70 72 69 6d 61 72 79 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -u-margin-bottom--8">\n <div class="bui-group__item">\n <button\n on:click="openModal"\n class="bui-link bui-link--primary"\n
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 2d 74 6f 70 2d 2d 31 36 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 27 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 67 72 6f 75 70 20 62 75 69 2d 67 72 6f 75 70 2d 2d 69 6e 6c 69 6e 65 20 62 75 69 2d 67 72 6f 75 70 2d 2d 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 2d 6d 69 64 64 6c 65 20 20 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 32 34 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: -top--16">\n <a href="','\n </a>\n </div>\n </div>\n <div class="bui-group bui-group--inline bui-group--vertical-align-middle bui-u-padding-top--24">\n <div class="
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 6b 65 6e 5f 6c 6f 61 64 69 6e 67 3f 74 68 69 73 2e 6d 6f 64 61 6c 26 26 65 2e 73 68 6f 75 6c 64 5f 6d 6f 64 61 6c 5f 61 75 74 6f 5f 6f 70 65 6e 26 26 74 68 69 73 2e 6f 70 65 6e 4d 6f 64 61 6c 4f 6e 41 75 74 6f 4f 70 65 6e 41 6e 64 44 69 73 6d 69 73 73 28 29 3a 28 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 69 73 5f 74 6f 6b 65 6e 5f 6c 6f 61 64 69 6e 67 3a 21 30 7d 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 34 64 3a 37 33 62 30 30 38 62 64 22 29 2c 65 2e 73 65 74 53 74 61 74 65 28 7b 68 61 73 5f 61 6a 61 78 5f 65 6c 61 70 73 65 64 5f 6d 61 78 5f 74 69 6d 65 3a 21 30 7d 29 2c 5f 72 5f 28 29 7d 2c 35 65 33 2c 74 68 69 73 29 2c 74 2e 61 6a 61 78 28 7b 75 72 6c 3a 6c 2b 22 2f 69 6e 63 65 6e 74 69 76 65 73 2f Data Ascii: ken_loading?this.modal&&e.should_modal_auto_open&&this.openModalOnAutoOpenAndDismiss():(this.setState({is_token_loading:!0}),setTimeout(function(e){_i_("44d:73b008bd"),e.setState({has_ajax_elapsed_max_time:!0}),_r_()},5e3,this),t.ajax({url:l+"/incentives/
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 41 52 44 5f 41 43 54 49 56 41 54 49 4f 4e 5f 53 55 43 43 45 53 53 3a 72 65 74 75 72 6e 20 5f 72 5f 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 65 2c 7b 69 73 4c 6f 61 64 69 6e 67 3a 21 31 2c 69 73 46 6f 72 6d 48 69 64 64 65 6e 3a 21 30 2c 69 73 4d 64 6f 74 41 63 63 6f 72 64 69 6f 6e 4f 70 65 6e 3a 6f 2e 66 65 5f 6d 64 6f 74 5f 61 63 63 6f 72 64 69 6f 6e 5f 6f 70 65 6e 5f 6f 6e 5f 72 65 77 61 72 64 2c 63 6f 75 70 6f 6e 5f 63 6f 64 65 3a 22 22 7d 29 29 3b 63 61 73 65 20 72 2e 52 45 54 52 49 45 56 45 5f 53 54 4f 52 45 44 5f 52 45 57 41 52 44 5f 43 4f 44 45 3a 72 65 74 75 72 6e 20 5f 72 5f 28 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 7b 7d 2c 65 2c 7b 63 6f 75 70 6f 6e 5f 63 6f 64 65 3a 6e 2e 70 61 79 6c 6f 61 64 7d 29 29 3b 63 61 73 65 20 72 2e 54 Data Ascii: ARD_ACTIVATION_SUCCESS:return _r_(Object.assign({},e,{isLoading:!1,isFormHidden:!0,isMdotAccordionOpen:o.fe_mdot_accordion_open_on_reward,coupon_code:""}));case r.RETRIEVE_STORED_REWARD_CODE:return _r_(Object.assign({},e,{coupon_code:n.payload}));case r.T
2024-01-15 23:16:16 UTC	8412	IN	Data Raw: 7d 29 2e 63 6f 70 79 7c 7c 7b 7d 29 2e 74 65 72 6d 73 5f 74 69 74 6c 65 29 2c 64 5b 34 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3b 76 61 72 20 6e 3d 28 28 28 6f 2e 4d 43 28 6c 5b 31 5d 29 7c 7c 7b 7d 29 2e 72 65 77 61 72 64 7c 7c 7b 7d 29 2e 63 6f 70 79 7c 7c 7b 7d 29 2e 63 6f 6e 64 69 74 69 6f 6e 73 7c 7c 5b 5d 3b 74 2e 75 6e 73 68 69 66 74 28 7b 63 6f 6e 64 69 74 69 6f 6e 3a 6e 75 6c 6c 7d 29 3b 66 6f 72 28 76 61 72 20 69 2c 72 3d 31 2c 61 3d 6e 2e 6c 65 6e 67 74 68 3b 72 3c 3d 61 3b 72 2b 2b 29 74 5b 30 5d 2e 63 6f 6e 64 69 74 69 6f 6e 3d 69 3d 6e 5b 72 2d 31 5d 2c 65 2b 3d 5b 64 5b 34 32 5d 2c 6f 2e 46 2e 65 6e 74 69 74 69 65 73 28 69 29 2c 64 5b 34 33 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3b 69 66 28 74 2e 73 68 69 66 74 28 29 2c 65 2b 3d 5b 64 5b 34 34 5d 2c Data Ascii: }).copy\|\|{}).terms_title),d[41]].join("");var n=(((o.MC(l[1])\|\|{}).reward\|\|{}).copy\|\|{}).conditions\|\|[];t.unshift({condition:null});for(var i,r=1,a=n.length;r<=a;r++)t[0].condition=i=n[r-1],e+=[d[42],o.F.entities(i),d[43]].join("");if(t.shift(),e+=[d[44],
2024-01-15 23:16:16 UTC	2513	IN	Data Raw: 5d 3b 72 65 74 75 72 6e 20 5f 72 5f 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 34 64 3a 63 64 36 35 64 34 66 35 22 29 3b 76 61 72 20 6e 2c 69 3d 22 22 2c 72 3d 74 68 69 73 2e 66 6e 3b 72 65 74 75 72 6e 20 6e 3d 69 2c 5f 69 5f 28 22 34 34 64 3a 66 66 37 65 37 33 62 65 22 29 2c 6e 2b 3d 5b 5f 5b 30 5d 2c 28 65 2e 75 6e 73 68 69 66 74 28 7b 63 6f 6c 6f 72 3a 22 23 42 44 42 44 42 44 22 2c 6e 61 6d 65 3a 5f 5b 31 5d 7d 29 2c 61 3d 72 2e 48 45 4c 50 45 52 28 22 69 63 6f 6e 22 2c 65 5b 30 5d 29 2c 65 2e 73 68 69 66 74 28 29 2c 61 29 2c 5f 5b 32 5d 2c 72 2e 46 2e 65 6e 74 69 74 69 65 73 28 28 72 2e 4d 43 28 74 5b 30 5d 29 7c 7c 7b 7d 29 2e 74 69 74 6c 65 29 2c 5f 5b 33 5d 2c 72 2e 46 2e 65 6e 74 69 74 69 65 73 28 28 72 2e 4d 43 28 74 5b 30 5d 29 7c Data Ascii: ];return _r_(function(e){_i_("44d:cd65d4f5");var n,i="",r=this.fn;return n=i,_i_("44d:ff7e73be"),n+=[_[0],(e.unshift({color:"#BDBDBD",name:_[1]}),a=r.HELPER("icon",e[0]),e.shift(),a),_[2],r.F.entities((r.MC(t[0])\|\|{}).title),_[3],r.F.entities((r.MC(t[0])\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49765	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	687	OUT	GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Content-Language: 45792 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * Date: Fri, 05 Jan 2024 15:17:35 GMT Cache-Control: max-age=2592000 ETag: "d266b8ba8cd5636f0ef98de21b5ec6eaa2e51112" X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WHibo0zADiafIsgl1Iy9vNC7jtifUIhmRP0dvUugKD7mocWNaHV7Yw== Age: 892721
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 62 32 65 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 f4 01 f4 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: b2e0JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 0f f4 07 a5 7a 37 8a 74 f1 79 a6 da 6b 36 ac b8 2a 23 94 7b e3 83 5b 4a fc ca c7 3a 51 de 47 2a 6e 59 7b 71 ef 50 c9 78 ed c7 18 35 13 41 33 be c0 41 24 e3 19 ab 69 e1 ed 46 6e 70 ab ec cd d6 86 e5 1f 89 83 54 5e c8 75 b6 b4 f6 b2 23 84 53 b4 71 cd 67 5f 4f 1d e4 8e ec b8 2c 73 c7 6a d4 1e 14 d5 1e 32 c1 10 e3 b6 ea ce bc d1 af ac 9d 56 68 f0 c4 64 0c d1 09 ab e8 f5 14 a3 4c cf 10 40 a3 92 d9 a2 93 38 c8 c1 a2 b6 bc c8 e5 a4 7d 12 af 53 29 cd 50 47 cd 58 57 c6 39 ae 24 c9 68 b8 a6 a4 53 55 95 b3 52 ab 55 5c 4d 16 01 f6 a5 f4 c5 46 87 de 9c 0e 4d 34 c9 24 56 c1 ab 31 be 6a 98 34 e5 7c 55 26 2b 16 25 4a 80 8c 1a 90 4f c6 08 cd 35 d8 31 c8 a4 d8 02 81 b7 9a a1 ab b7 97 a5 5c 30 fe ed 5d 1d 2a a6 a8 be 66 99 3a fa a5 27 b1 4b 73 cd 27 e4 1e 7d eb 14 90 b1 c8 Data Ascii: z7tyk6#{[J:QGnY{qPx5A3A$iFnpT^u#Sqg_O,sj2VhdL@8}S)PGXW9$hSURU\MFM4$V1j4\|U&+%JO51\0]*f:'Ks'}
2024-01-15 23:16:16 UTC	13032	IN	Data Raw: ca 3e de 80 0e 99 ad 1f 14 8c cd 62 bd d6 0c 7e a6 9c 7f 80 fd 51 15 35 c6 41 76 4c c0 f9 48 39 e9 4d 31 e4 fc a2 9c 00 dd 8e b4 10 d9 f6 ae 63 bd 1d 39 5f 2b c2 17 44 70 e3 cb 01 bb f5 35 cb 7d aa e1 3a 4d 27 fd f4 6b aa bb ca f8 52 e9 73 d5 e3 fe 75 c9 ed e7 3b 85 75 e2 5b 52 49 76 47 9d 80 8a 95 39 36 b7 93 26 5d 42 e8 1f f5 cf c0 f5 ae 8b c3 3b ef a7 51 3b 96 52 71 fa 57 2f 80 3a 75 ae a3 c2 99 57 56 cf 42 69 e1 65 27 53 7e 8c 9c c6 9c 55 0b a5 d5 7e 66 33 de df 07 6c 4c 70 09 02 a2 37 b7 ac 79 b8 71 f4 35 55 dd 84 8f cf f1 1f e7 4c 32 1d d8 c1 ae 7e 79 f7 3b 95 2a 4b ec af b8 d9 d2 24 9a 5b df de 4d 23 8c 74 66 27 bd 41 ae 90 35 59 46 78 07 00 54 da 06 5a f0 83 9e 83 f9 d4 1a ca e7 57 b9 c1 fe 3c 57 44 df fb 3c 5b ee 71 52 4b eb d3 b7 f2 a3 3b df 8c Data Ascii: >b~Q5AvLH9M1c9_+Dp5}:M'kRsu;u[RIvG96&]B;Q;RqW/:uWVBie'S~U~f3lLp7yq5UL2~y;*K$[M#tf'A5YFxTZW<WD<[qRK;
2024-01-15 23:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49760	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	628	OUT	GET /static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	780	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 95 Connection: close Server: nginx Date: Tue, 19 Dec 2023 16:59:41 GMT Last-Modified: Wed, 10 Apr 2019 11:21:38 GMT ETag: "5cadd1c2-5f" Expires: Thu, 18 Jan 2024 16:59:41 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: jrM_0QuqN5O5iorIhVHBgb7e5w_ugCy4t9W9BZBnxQneZMbqCTZg2A== Age: 2355395
2024-01-15 23:16:16 UTC	95	IN	Data Raw: 77 69 6e 64 6f 77 2e 62 5f 63 72 6f 73 73 6f 72 69 67 69 6e 5f 73 75 70 70 6f 72 74 3d 31 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 62 5f 63 6f 72 73 5f 63 68 65 63 6b 26 26 77 69 6e 64 6f 77 2e 62 5f 63 6f 72 73 5f 63 68 65 63 6b 28 21 30 29 3b Data Ascii: window.b_crossorigin_support=1,"function"==typeof window.b_cors_check&&window.b_cors_check(!0);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49767	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	627	OUT	GET /static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 5619 Connection: close Server: nginx Date: Sun, 31 Dec 2023 05:24:22 GMT Last-Modified: Tue, 04 Feb 2020 10:19:57 GMT ETag: "5e39454d-15f3" Expires: Tue, 30 Jan 2024 05:24:22 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: TdbtGXPlXlIczya848-avw0rd-G2OWz0OjTriJCzZcG7oCD6zh7rNg== Age: 1360314
2024-01-15 23:16:16 UTC	3198	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 49 6d 61 67 65 4c 61 7a 79 4c 6f 61 64 65 72 28 29 7b 5f 69 5f 28 22 37 39 36 3a 61 33 63 34 65 32 30 38 22 29 2c 74 68 69 73 2e 68 69 67 68 52 65 73 51 75 65 75 65 3d 5b 5d 2c 74 68 69 73 2e 73 68 6f 75 6c 64 4c 6f 61 64 48 69 67 68 52 65 73 3d 21 31 2c 74 68 69 73 2e 76 69 65 77 50 6f 72 74 45 78 74 65 6e 64 65 64 48 65 69 67 68 74 3d 6e 75 6c 6c 2c 74 68 69 73 2e 69 73 57 61 74 63 68 69 6e 67 46 6f 72 4e 65 77 49 6d 61 67 65 73 3d 21 31 2c 74 68 69 73 2e 73 75 70 70 6f 72 74 73 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function ImageLazyLoader(){_i_("796:a3c4e208"),this.highResQueue=[],this.shouldLoadHighRes=!1,this.viewPortExtendedHeight=null,this.isWatchingForNewImages=!1,this.supportsIntersectionObser
2024-01-15 23:16:16 UTC	2421	IN	Data Raw: 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3d 27 75 72 6c 28 22 27 2b 6e 2b 27 22 29 27 2c 5f 72 5f 28 29 7d 2c 69 2e 73 72 63 3d 6e 2c 5f 72 5f 28 29 7d 2c 6c 69 73 74 65 6e 4d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 37 39 36 3a 63 39 30 30 65 32 63 32 22 29 2c 22 4d 75 74 61 74 69 6f 6e 45 76 65 6e 74 22 69 6e 20 77 69 6e 64 6f 77 26 26 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 4e 6f 64 65 49 6e 73 65 72 74 65 64 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 37 39 36 3a 62 64 33 38 34 33 36 62 22 29 3b 76 61 72 20 74 3d 65 2e 74 61 72 67 65 74 3b 69 66 28 31 21 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 Data Ascii: .style.backgroundImage='url("'+n+'")',_r_()},i.src=n,_r_()},listenMutationEvents:function(){_i_("796:c900e2c2"),"MutationEvent"in window&&document.body.addEventListener("DOMNodeInserted",function(e){_i_("796:bd38436b");var t=e.target;if(1!==t.nodeType)ret

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49769	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	679	OUT	GET /xdata/images/city/600x600/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 29 Dec 2023 21:09:31 GMT ETag: "573504c191cc2c1f809824eea3d70a8a67bc3b26" Content-Language: 90590 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: UkhugZdf7dov-14K-ou-AoR-a6LmRkjdH4NwmUoYpZmGhNtBkvQyjg== Age: 1476404
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 66 62 63 61 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: fbcaJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: f2 47 1b a7 b4 32 6b 6a f7 27 fd 1a 2c c9 29 ce 3e 45 e4 f3 ef c8 1f 51 55 3c 68 64 9d 92 ea 5f f5 92 9d ef ce 79 39 cf e1 e9 47 98 2d e1 66 de 54 ca 77 b3 0e a1 10 e7 ff 00 42 19 c7 fb 1e f5 7e 5d 1b ed df 0f ee 75 77 91 bc d8 ee 3e 68 c8 27 6e 42 90 07 d1 48 a9 8c 6d 69 0e 73 e6 72 47 9f 30 c6 69 38 c0 a7 ba 80 e6 9b 8e 2b b5 1e 6b dc 6e ec 9c 0c 54 91 23 4c cb 14 63 73 9e 00 1d ea 2d aa 0e 4b 73 4a ac 01 e0 1c fa d0 4c 5b be a2 cb 1b a9 c3 29 04 76 23 14 53 8b 33 0c 12 4f 3d e8 a1 31 ca 29 bb 9a f7 69 08 86 30 b2 e1 7a 98 f7 67 07 a1 39 f7 c0 ad 2b 7d 1f 7e 95 0c f1 79 52 12 03 05 2e 09 2e 4e 00 20 1c f4 5f 4e fd 6a 95 bc 31 dd 19 ee 59 84 61 48 7e 5b 2c de a0 03 c9 35 d7 69 ba c5 9d 97 82 6f 62 6c 0b bb b9 c0 52 47 cc a3 92 71 c7 07 ee f3 e8 4f be 72 Data Ascii: G2kj',)>EQU<hd_y9G-fTwB~]uw>h'nBHmisrG0i8+knT#Lcs-KsJL[)v#S3O=1)i0zg9+}~yR..N _Nj1YaH~[,5ioblRGqOr
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 29 3e cc f3 2c 68 df de 3f d3 8c 7f 9e 9d 56 97 a1 3e a3 a7 43 7b 14 72 03 0d d0 1e 51 53 f3 12 19 b3 8f 62 00 e3 fb dc e2 b7 a3 39 ba b6 66 53 4b 97 43 5f c1 b7 13 c5 e3 07 8a 5b a5 95 2e 25 03 7a b7 ca 7c b5 38 fc 48 db f9 d7 ac b6 3d 45 71 fe 1c f0 aa d8 eb 9a 8c d3 c2 10 3e d6 0d 8c 94 70 4b 0c 13 f4 53 9c 1f e5 9e d6 3b 98 6e 1a 64 68 c0 96 27 2a 48 1c 36 31 f9 70 47 e7 5e 9a aa 9e 84 7b 37 6b 90 15 04 66 a3 21 7d 6a 67 de e4 81 db f0 a8 76 31 e7 1c 56 c8 cd 8c 38 cf 5a 61 14 f2 a6 93 69 aa 44 0c 22 90 8a 7e da 36 9a 60 47 8a 29 db 69 08 a6 21 b9 a4 cd 2e 29 31 40 82 96 93 6d 2e c3 4c 02 92 82 a6 90 83 40 0b 48 4d 21 06 90 d3 10 b9 e2 8c d6 6e ad ad 58 68 76 cb 3e a1 72 b0 23 b6 d5 c8 27 27 19 e8 05 65 e9 5e 3a d0 b5 56 d8 97 4d 6f 21 7d 8b 1d c2 ed Data Ascii: )>,h?V>C{rQSb9fSKC_[.%z\|8H=Eq>pKS;ndh'*H61pG^{7kf!}jgv1V8ZaiD"~6`G)i!.)1@m.L@HM!nXhv>r#''e^:VMo!}
2024-01-15 23:16:16 UTC	15314	IN	Data Raw: 8a 78 20 d2 80 0d 17 0b 09 b4 76 a1 cf c8 7e 94 ec 0a 6b 8f 91 be 95 2d 8c f9 cb c4 2a 4f 89 75 46 3b c3 19 4f df 39 6e a7 a7 b7 ff 00 5a b1 57 ef c8 39 fc 6b 67 5b 0b ff 00 09 0e ab 82 9c ca 4e 13 e6 1d 4f 53 eb fd 73 58 e8 70 d2 7f 4a f5 a8 ff 00 09 1e 1e 26 de dd 88 fc c4 c0 86 0a 09 07 23 8e 82 b7 7c 3a 0f f6 2c 99 dd c3 0e 58 7b 2f e9 58 2e 30 ac 70 bf 50 7d ab a0 f0 e2 af f6 24 9b 70 32 fd 8e 4f 41 4e ab 16 1d 2b 7d c7 b7 e8 7f f2 03 b1 ff 00 ae 2b fc aa fe 2a a6 87 1b 7f 61 d8 ff 00 d7 15 fe 55 7c a6 3a b0 af 35 bd 59 eb c5 3b 22 3c 51 8a 79 03 15 cf c9 e3 3d 0a 37 d8 d7 c8 18 36 d2 ad c3 67 a6 30 7d e8 b8 ec 6e e2 93 14 8e eb 1a 17 66 00 7a 9a 48 a4 13 44 b2 2f 46 19 a6 21 71 49 4e a3 14 00 da 4a 7e 29 31 40 0d c5 26 29 f8 a3 14 5c 2c 37 14 62 9f Data Ascii: x v~k-OuF;O9nZW9kg[NOSsXpJ&#\|:,X{/X.0pP}$p2OAN+}+aU\|:5Y;"<Qy=76g0}nfzHD/F!qINJ~)1@&)\,7b
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 36 33 66 30 0d 0a b2 fb 36 9b 06 f2 3e 74 52 bf 2c 6c 72 09 04 e7 3c 1e e0 74 ae 6b 56 f1 0d dd cd ce 1a 49 04 79 3b d5 06 01 40 c7 20 8f e2 e3 a1 cf ad 5e d0 f4 e4 b8 d5 ac 2c dc 47 1d c3 c6 ec b1 a9 dd 95 03 72 8f 42 71 fa 1f ad 77 52 78 36 c2 08 6e a6 93 97 95 c8 1b 78 11 a8 27 00 0c 7a 63 3e f5 e7 d3 f6 f2 d6 2b 43 3d ce 7b c3 6c d7 ea 7e c7 14 e2 13 99 15 df e6 29 f7 06 32 79 3c 0e 3b 70 3a d5 fb d9 2d 2d ae 85 cc 96 ec 63 55 7c 8c 7d c0 73 bb 20 71 9d c4 fe 1f af 4b a6 da c1 63 6d 1a 42 02 aa 29 45 c8 e4 2e 7a 67 d0 57 3b e2 d9 94 e9 32 b2 b6 77 70 40 1f fd 7f ad 7a 30 a3 64 93 21 ad 09 2d fc 79 a4 c1 14 71 4b 14 8c 57 8d c5 40 24 0e 07 73 e9 eb 5b 2b e3 6d 11 41 de ef 19 03 3c a6 72 3f 0a f1 30 c5 a7 db ea 7a 9a d1 9d e5 df e4 a5 be c5 c0 0b bb a9 Data Ascii: 63f06>tR,lr<tkVIy;@ ^,GrBqwRx6nx'zc>+C={l~)2y<;p:--cU\|}s qKcmB)E.zgW;2wp@z0d!-yqKW@$s[+mA<r?0z
2024-01-15 23:16:16 UTC	9208	IN	Data Raw: 6e e9 9e 54 ee 1f d6 99 6f 27 95 70 ad db 38 35 56 ba b0 af 69 26 76 1a 2d bc 37 9a a5 85 b4 fc 47 32 dc 44 c7 d3 28 71 dc 7a d7 39 6a d2 69 9a d3 44 e4 29 0c d0 bf 71 83 95 3d 3a f5 ad dd 0e 53 fd bf a6 a9 29 b0 5c 1f bd d3 e6 00 1c d5 5f 1c 42 91 78 a2 e2 58 8a ed 7d ad 95 93 78 27 03 3c e4 e7 9f 7a ce 1b d8 aa 9b f3 22 a6 bb a6 1b 28 ec 2e d3 3e 55 d4 39 0e 3a 16 52 54 e3 f2 07 f1 ad a5 9a de eb c3 fa 2c a5 63 2f 15 d0 89 c1 19 24 64 b7 39 07 23 90 3a 7e 15 2c b6 7f da df 0e 56 e6 25 cb 58 c8 4b 62 31 dc f3 c8 5f 43 9e 49 e9 5c a5 9c e5 61 64 fe eb 87 1f e7 f1 aa de 3e 84 ad 25 ea 76 fe 3d d3 2d ac f4 e8 76 58 c3 6f 29 62 43 22 28 2c 06 38 e1 57 d7 d2 8a 97 c6 3a a5 8d ee 9b 6f 1d ad d4 33 3a 49 b8 22 30 61 cf d1 57 f9 51 4a 0d a5 66 0d 29 11 78 46 21 Data Ascii: nTo'p85Vi&v-7G2D(qz9jiD)q=:S)\_BxX}x'<z"(.>U9:RT,c/$d9#:~,V%XKb1_CI\ad>%v=-vXo)bC"(,8W:o3:I"0aWQJf)xF!
2024-01-15 23:16:16 UTC	555	IN	Data Raw: 32 32 34 0d 0a 9d 4d 09 c6 50 1f d0 d1 45 4c fe 17 ea 38 ee 8a 7e 1e 6d ba fd b9 27 ae f1 cf fb a4 55 6b c1 fe 95 29 ff 00 6d bf 9d 14 55 bf 8f e4 25 f0 fc cb be 22 4f 9e d0 9e 7f d1 d2 9b 64 a6 1d 06 5b a5 66 f3 16 5d 80 13 95 23 03 82 3f 13 45 14 a2 ff 00 76 bd 41 af 7d 9a 96 f7 06 7d 02 47 c6 d0 41 05 73 df 3d ab 9a 48 c4 f3 90 d9 00 fb f4 a2 8a 9a 5a 39 58 2a 6a 91 29 d3 9f 71 f2 db 76 3a 8e f5 22 5b 82 bb 24 8c fb 10 71 8a 28 ad 63 26 f7 30 92 b6 c7 77 f0 ca 4b 5b 0d 76 65 bb 70 23 96 0d 8a cf 19 23 76 e0 40 f4 e9 9e 6a cf f6 2e a7 71 73 1b 47 63 39 45 27 07 66 dc 0c f6 26 8a 2b 9e b4 53 67 4d 07 a1 77 41 d2 3c 67 15 ca ad d7 90 2d 77 f3 e7 c8 0b 05 f6 c1 c9 fc 6b b2 8b 49 9e 42 5e e6 78 97 b0 54 cb 7a fb 0a 28 a9 69 32 d6 83 97 4a 82 29 09 92 69 9f Data Ascii: 224MPEL8~m'Uk)mU%"Od[f]#?EvA}}GAs=HZ9X*j)qv:"[$q(c&0wK[vep##v@j.qsGc9E'f&+SgMwA<g-wkIB^xTz(i2J)i
2024-01-15 23:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49771	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	631	OUT	GET /psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	621	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 62401 Connection: close Last-Modified: Fri, 05 Jan 2024 15:15:01 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: NK1_gqSh5LuI_tyN8odLCBlL9CVWM7_o Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 19:23:59 GMT ETag: "d8c78bb4aa47ab6ae3df9d9e2fd9501e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 8Xp6cAK-4_bEj2woQvaiFQM7rejFoQIpOY2fFtkN66jwoxa3nkDWGQ== Age: 13937 Vary: Origin
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 ca 00 00 01 d7 08 06 00 00 00 a5 36 7c 98 00 00 20 00 49 44 41 54 78 5e ec dd 77 9c 9d 67 79 e7 ff cf fd 3c a7 4f 3b 53 d5 a5 51 b5 64 b9 c8 b8 57 24 5b c6 05 0c 36 10 92 10 b2 b0 bb 64 c3 26 bb 20 12 db a4 fc 12 3b 7d 03 49 68 af 25 9b 5f d8 38 a4 d0 1d 1b 83 c1 15 c9 36 ee 45 92 25 ab f7 3e bd 9e 39 fd b9 f7 8f 19 c9 b2 a7 3c 67 34 67 ca 99 f9 be 5f 2f 61 49 e7 7a 8e c4 d4 af ee 73 3d d7 05 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 52 7c c6 af 40 Data Ascii: PNGIHDR6\| IDATx^wgy<O;SQdW$[6d& ;}Ih%_86E%>9<g4g_/aIzs="""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""R\|@
2024-01-15 23:16:16 UTC	12398	IN	Data Raw: e7 79 fc 58 da 3d 23 d9 5b cf bc 7b de 73 14 45 39 9a 40 0c 5d 9a a7 28 ca 98 4a 8e 44 d9 10 26 92 4e 24 93 31 5d b7 30 65 8a c7 e9 90 b8 b0 58 ee 14 72 98 94 5d f1 5c 48 00 00 20 00 49 44 41 54 d3 d0 8d d9 43 c6 08 f6 0c 79 bd e2 c8 94 02 d3 8a f4 3b 76 e9 16 ae 21 ca 2a 34 21 b1 fb 5b bf 39 71 69 61 d2 8d 1e a7 30 45 51 94 f7 52 9d 2f 14 25 81 24 47 a2 ac 87 6d 84 e8 02 40 72 0d bd 95 63 3f 2a b4 7a 79 01 02 e7 fe c8 47 b8 10 d6 25 43 05 68 88 9a fe 8a 00 65 84 c2 96 81 d5 bf 42 ec 33 cc 21 5b bf e9 c2 46 4a 0d 3b 8a 5b 5c 20 29 74 ab e1 89 8a a2 0c 5b 65 d6 17 de 7a ef d4 56 45 51 4e 90 e4 48 94 83 98 40 64 36 b1 a0 08 cd be 85 82 55 85 4e 87 c5 54 9f 67 01 88 21 4b 29 8e 63 8b 8b a9 5c 31 d8 60 12 d0 c4 01 21 18 bc 9f 99 e2 28 64 69 84 ad c8 d3 20 c5 Data Ascii: yX=#[{sE9@](JD&N$1]0eXr]\H IDATCy;v!4![9qia0EQR/%$Gm@rc?zyG%CheB3![FJ;[\ )t[ezVEQNH@d6UNTg!K)c\1`!(di
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 3c 2f ae 62 14 4f 44 45 51 48 9a 44 59 ca c6 18 e6 04 83 10 19 04 65 26 d0 84 2e da b1 64 1c 8a 4e 4f 1c cb 16 58 6a 45 f9 18 5e c3 e4 0b cb 5f e3 99 3d 95 74 07 bd 3c bc 71 2e 2b aa 6a b9 70 fa 6e a7 43 0f 9b 94 d9 c9 9d ab d6 72 e5 1f ae e2 bb 6b 4f e5 c1 2b 1f 8b 6a 80 c9 c8 48 e8 78 19 36 7f 04 59 71 33 a2 f4 ba fe 24 30 46 f7 ab 2b 07 51 7a 3d b2 f9 71 68 79 c2 29 7a 08 a3 38 a9 4d 99 82 98 f6 23 a4 91 0b 07 1f 18 5e a7 0d 57 76 64 88 48 f9 a7 11 85 57 46 4a 3f 44 9c 5e 22 cd 1e a8 bd 1b 3a 8f 4c 8e 13 48 e6 a6 6f e1 bb d3 ef e4 d6 ed 77 b0 b3 f7 c8 c0 4f 65 f8 82 b6 9b 1b fe 71 25 69 5a 27 2e 2d 92 2f 4a 19 a9 23 3e a6 ae d8 8e 6c ba b3 a5 86 ec ff 3a b2 27 e3 48 e9 45 d8 d6 f1 9b 91 a4 36 70 38 31 76 45 52 70 79 64 af e9 d1 9d 81 84 e8 7f 24 f7 5f Data Ascii: </bODEQHDYe&.dNOXjE^_=t<q.+jpnCrkO+jHx6Yq3$0F+Qz=qhy)z8M#^WvdHWFJ?D^":LHowOeq%iZ'.-/J#>l:'HE6p81vERpyd$_
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: e4 65 45 59 08 61 4b 29 7b 93 8b fa 46 b5 92 4c b9 a4 a2 59 5b 65 84 fe 30 b6 f5 66 35 2a 4e 29 26 b6 14 1c ec 48 54 94 35 21 59 dd 98 d6 99 34 ac 23 e8 a7 6d a0 94 b5 33 db 32 de 3f 56 a7 23 b3 e8 37 2b 9c c2 26 8d 44 7e 2d 1e d7 ee 09 dc b7 60 c2 ad 72 ca 18 49 8f 40 98 46 da 88 26 49 34 63 ac 11 8f 83 71 7e 81 8e 44 47 d7 f3 32 3f 50 94 c9 96 cf bf 08 fd 40 44 25 ca 79 21 98 4c 96 2f 64 c7 f7 09 5d 7b 59 da ac 00 54 05 43 29 0a 83 51 0f 6d 03 a5 48 29 a8 f1 87 98 59 1a cc 18 d7 3d e4 a7 37 ec 63 71 5d e6 8a f3 58 58 52 a7 2d 3a e3 a2 f4 28 4b c9 56 89 75 af aa 20 5f 42 b6 2d 90 32 fd 35 5e 13 71 32 71 95 98 98 f1 f3 19 b5 40 60 cb 7c ce 0f 14 65 d2 e4 6b eb 05 c9 f1 70 99 93 2f 65 ba 19 4c be a9 b9 80 b8 83 21 2c fb e7 c8 89 2f ce 54 94 7c d1 11 f4 71 Data Ascii: eEYaK){FLY[e0f5*N)&HT5!Y4#m32?V#7+&D~-`rI@F&I4cq~DG2?P@D%y!L/d]{YTC)QmH)Y=7cq]XXR-:(KVu _B-25^q2q@`\|ekp/eL!,/T\|q
2024-01-15 23:16:16 UTC	851	IN	Data Raw: a5 8f fb 13 30 d0 60 76 fb 74 68 f9 5c ba 60 5a 4a a4 85 d2 5a ae 2f 65 07 65 fb 4a 67 4d f7 f5 f2 49 4f a4 5b d7 3b b8 33 26 27 70 2f 96 3a c5 0e 7a 13 68 d0 4e 61 0d 34 b9 53 76 03 6d c8 8c 21 50 39 44 1a 93 6b aa 91 46 72 4d 32 63 20 d6 c4 61 4e 27 37 74 72 43 a5 6d 88 33 83 a9 69 3a 6d 43 9c 1a b8 4c b3 7f 12 36 6e d0 ec d9 03 9b 0e 68 f6 5f 6c d8 38 6d b8 f3 80 e1 53 db b4 5f 76 e6 f1 78 3c a7 2f 8f be e2 7a b5 51 6c 46 38 82 62 12 61 cf 2e c5 13 2b c2 b1 0b 05 ee 52 34 37 08 32 a3 e8 04 42 35 10 aa 4a 98 6e 2b 12 25 54 02 21 6e d9 dd db cd 50 91 b6 85 e5 63 d2 75 19 24 a9 22 53 d6 45 50 ae ac 82 5e b8 10 ca 13 bb 83 3b 48 a5 6f 33 0c 6e 73 4c 1c f7 d2 94 dd 04 01 71 69 83 0c a5 0d 30 79 26 dd 05 72 45 be 48 c7 2e 3f b8 81 06 ef 36 c8 73 1a 30 6c a9 Data Ascii: 0`vth\`ZJZ/eeJgMIO[;3&'p/:zhNa4Svm!P9DkFrM2c aN'7trCm3i:mCL6nh_l8mS_vx</zQlF8ba.+R472B5Jn+%T!nPcu$"SEP^;Ho3nsLqi0y&rEH.?6s0l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49770	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	685	OUT	GET /xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2373fb877f2b10681ae8abbb7a0c63613&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 20 Dec 2023 10:11:33 GMT ETag: "fd71ca1d4ae81d5c5ce8bc184e9100bca098389a" Content-Language: 31784 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vCvdLznJtZOdV0YxssKp9-v87tPpo8jcodaHqZf9_Dk6l4wWwwNKRA== Age: 2293483
2024-01-15 23:16:16 UTC	16384	IN	Data Raw: 37 63 32 38 0d 0a 52 49 46 46 20 7c 00 00 57 45 42 50 56 50 38 20 14 7c 00 00 10 ae 01 9d 01 2a 1c 02 95 01 3e 6d 32 95 47 26 24 23 21 a9 56 0a 50 c0 0d 89 63 6e d7 a8 cc ac 19 26 43 97 98 18 8e 4f 29 2e f5 be d8 c9 69 39 41 bc e8 8c 36 ae 7b ea 8d de 5f f0 3e 35 ff e5 f1 af e1 bf ef f9 bb 7b 27 7b 4f fa 1e bd f9 cf fa b0 e7 71 f3 70 f4 7a ea d7 f4 5c f3 5a ff d5 ed 71 e9 81 a6 77 2e 4f 3d fb 93 e0 af 8f 0f 71 7e eb f9 15 ee 13 91 3f 7f fe f3 cc 6f b4 3f d7 ff 2b ed 73 f9 5f fb df e7 3c 65 f8 f3 fe cf f9 ff 60 bf cf 7f a7 ff c4 ff 03 eb 9f f6 9d b6 fb 37 fa 9f da ff 60 bf 77 7e e1 fb 2f fe 97 f6 a7 e2 b3 eb 7c d7 fb 4b ec 07 e5 67 fc ff 0c 3f c4 7f bc f6 05 fd 33 ea eb fe 37 ee 27 a4 ef d8 3f da fe dd fc 0d 79 6f 7f ff f7 a5 fb ad ff ff de 97 f6 93 ff f9 Data Ascii: 7c28RIFF \|WEBPVP8 \|*>m2G&$#!VPcn&CO).i9A6{_>5{'{Oqpz\Zqw.O=q~?o?+s_<e`7`w~/\|Kg?37'?yo
2024-01-15 23:16:16 UTC	15408	IN	Data Raw: f9 8c 9b fb f0 dd 24 16 0a 24 d6 24 ca 8d af f4 e5 9d 5c d0 c2 02 f1 25 61 d8 e5 af 27 80 c9 95 31 4e e7 89 d9 67 e1 5e 99 6b be 21 cf b4 b4 19 39 b7 a7 db aa ce a8 fa 1a 1c 80 21 1b fd e8 f6 9d 98 2d f7 1f b1 10 92 da 2c 8a 99 39 21 b1 b1 b2 96 bc 49 fb bf e5 a4 31 50 52 4d aa c4 f2 76 93 b7 64 6b 61 2b a2 7b 82 05 fe 10 65 89 f6 e2 f5 3a 97 e9 4e c7 9b 6a c9 64 78 a7 99 e2 55 cc b6 41 49 42 43 d1 7d e7 76 bd e3 62 45 cf 99 e2 8b fb 01 14 e4 47 4e 63 e0 82 63 6f aa 27 96 18 23 43 63 32 d0 c4 3a 29 cc 09 d0 24 ce a6 0b 16 08 6b 0f e9 ea 3b 06 cb 40 10 bc 96 f2 23 47 18 d7 63 42 ee 49 0d 1a eb eb c9 29 21 60 50 b4 e2 be 05 90 a7 84 46 6c ce 34 cc a8 4c 85 76 b4 31 1c 88 e7 8b 04 56 10 c0 4c 6c a7 1d 7f de ec 15 c7 e6 95 e2 e9 8a 2d 2a dd 6b 6d eb 08 4d a1 Data Ascii: $$$\%a'1Ng^k!9!-,9!I1PRMvdka+{e:NjdxUAIBC}vbEGNcco'#Cc2:)$k;@#GcBI)!`PFl4Lv1VLl-*kmM
2024-01-15 23:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49768	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	649	OUT	GET /design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	533	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 19613 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:03 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:16 GMT ETag: "46a2de536918e78228ad39f6c9bced54" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 0f954bea3b233fb0b6e1981b1e8b6bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: SHKj26uzztQwWmsTPkdJrY7s6qXepB50u92j4AiiqC9NVAOzw-zgtw== Age: 6223 Vary: Origin
2024-01-15 23:16:16 UTC	15851	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 04 00 00 01 04 08 03 00 00 00 f9 d6 ba 38 00 00 02 fd 50 4c 54 45 4c 69 71 bb db f5 82 8f a3 7b 86 99 fd b6 00 bf de f5 fd dd 91 b8 b1 9e a6 c7 e4 fb a5 27 7b 89 a1 7d 8a a1 8c 9f b7 ba db f4 7c 87 9b 7d 88 9d 79 85 9a af d4 f4 bd dd f5 70 79 8e fd b3 36 8d c0 f1 bc dc f5 b5 d8 f4 bb db f5 fc 9b 03 bc dc f5 a7 cf f3 2a 58 a6 76 95 c8 bc dc f5 f6 6b 00 bc da f1 0a 3f 96 ff b5 00 04 56 be 8b a7 d3 77 81 96 72 7b 90 ba da f4 72 7e 95 22 75 d4 bb dc f5 bd db f0 ba db f4 bd dc f4 fe b5 02 0e 5e c1 ff b6 00 fe de 90 03 47 a8 fe b4 04 fd dc 8d f9 87 02 bb db f5 bb db f4 ba da f4 fe b2 02 0a 58 bc ff b5 01 4c 89 d3 bb db f4 bb db f4 ff de 8f ff de 90 ff df 91 b8 d9 f4 bb db f5 26 7f e0 bb db f4 f6 6e 00 fe Data Ascii: PNGIHDR8PLTELiq{'{}\|}ypy6*Xvk?Vwr{r~"u^GXL&n
2024-01-15 23:16:16 UTC	3762	IN	Data Raw: 8c 3e 97 4d ed 9d ae 9f 76 d7 c8 5b 46 30 fc f4 3e bc 0f 9e 07 8a 8e f3 b8 60 88 bb 7f cf 50 9c a4 18 12 f6 26 70 68 3c b1 14 6b 18 ca 7a 6c a2 c0 71 22 cf 29 ae 6c 07 47 44 22 0e 9e 5b ef fd f8 83 3f c2 3e d7 85 6e c6 1c 0a d0 66 e9 59 b7 a1 4c bf d8 84 99 c6 c0 70 e3 0f ef d9 86 9e 6b a8 3d d6 cf 65 b1 39 1c fd 43 06 92 71 92 0c 34 dd 71 0a ee 12 44 ee 54 54 55 08 0b 2e 81 13 6d 42 98 13 eb 7d bc aa 7e b9 fd e0 82 9f 5c e8 5e a0 99 09 bb 05 54 13 38 c3 a4 a9 eb 7a ec cb ae d1 38 01 7d cf 88 61 a5 ff 97 0d 1e 98 8e 6e d9 e6 70 c1 41 2f d5 b1 a7 cf 00 27 04 28 d0 41 24 e3 74 1a f6 70 a2 3f 2b 88 04 ef f3 38 1c 9c 4b e5 62 1e 62 f7 82 05 dd dd dd b7 5f f0 c1 80 cc 84 5d 31 c3 6e 45 21 a1 9f d5 db 3b 69 f5 8c 6b b0 11 6f 30 16 61 45 8f 71 36 ed 21 c0 84 76 Data Ascii: >Mv[F0>`P&ph<kzlq")lGD"[?>nfYLpk=e9Cq4qDTTU.mB}~\^T8z8}anpA/'(A$tp?+8Kbb_]1nE!;iko0aEq6!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49772	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	657	OUT	GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1628 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-65c" X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AvscPPPhTjI5XEYB41WaKw77kFh5Qtrby8e7Qu_EfwbS0U0taw2Oxg== Age: 1485895
2024-01-15 23:16:16 UTC	1628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 06 00 00 00 d8 32 20 50 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 05 b0 49 44 41 54 68 de ed d9 7d 6c 5f 65 15 07 f0 4f 3b 9c 1a e7 84 a1 88 a6 2a c2 4c e6 f6 53 27 be 47 2f 6e a2 cb 32 32 9d 62 64 be b4 73 fb 8d 28 64 b2 78 8d 98 b8 28 4a 88 e0 1f de d4 21 11 c6 aa bc cf 45 02 9b 0e 25 2c c2 e0 32 03 03 75 63 65 44 7c 19 93 1f 63 c8 d8 98 a8 98 ce 75 fe f1 9c 5f 7b 5b 5b 5c 4c 6d 33 ec 37 b9 f9 9d e7 9c e7 3e 2f df e7 3c e7 9c db b6 1c 3e 7c d8 38 46 07 ad 63 bd 80 ff 27 8c 93 3d 8a 18 Data Ascii: PNGIHDR[2 PgAMAa cHRMz&u0`:pQ<bKGDCIDATh}l_eO;*LS'G/n22bds(dx(J!E%,2uceD\|cu_{[[\Lm37>/<>\|8Fc'=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49773	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	659	OUT	GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-637" X-Cache: Hit from cloudfront Via: 1.1 d01a0cfc47d6e412dd81c986ff5d69da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: BTRuULDRlax13XnvlH02owZ0uFvOf9SQWMEzUJvwxzDmWnFKrGiI-g== Age: 1485895
2024-01-15 23:16:16 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 03 00 00 00 ef ec d0 62 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 02 2e 50 4c 54 45 ff ff ff 00 00 00 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 Data Ascii: PNGIHDR[bgAMAa cHRMz&u0`:pQ<.PLTE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49774	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	655	OUT	GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1154 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:09 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:09 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-482" X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: hyqDriDFjdpMWiz1KCT7h1m3OV4N7M4NVtxWYqp4jRppLYuXPS94zw== Age: 1485907
2024-01-15 23:16:16 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 1a 08 06 00 00 00 f6 77 01 c2 00 00 04 49 49 44 41 54 78 01 ed 98 03 b0 ed 3a 18 85 73 6c 9f 67 db b6 79 6d df 7b 6c 6c 3d db b6 6d db b6 6d db b6 cd ef b5 b3 66 5e f6 41 b3 31 7a 68 67 fe 69 3a c9 ca ca 5a 4d fe a4 35 40 18 59 46 9a 0d c3 08 cd 0b cd 0b cd 0b cd 0b cd eb af fa c0 8b 6f b3 88 03 bc 68 55 39 ab 98 e0 c5 dd ff 42 ee 73 bd 68 f2 e2 1c df 3c b2 8c 93 bc 88 91 3d 7e 96 17 af fe 0b b9 ef f2 62 8a 17 27 18 b9 a9 0a e2 35 d0 6c 60 aa 81 56 a3 e7 e9 7a a6 a7 14 62 35 c9 9d 1c ee 45 d7 a0 8e 85 e9 c8 17 c6 8f ee 92 c1 38 85 06 f0 a8 17 10 a9 f6 a2 06 66 0a 43 5b 0e 6c 53 03 8d 7a a6 49 63 49 8b bb cd 58 ee de 72 88 3a b9 87 ea ee 2e d6 78 a7 59 dd 83 fa b8 11 f0 7d 2b 1b 68 5e 47 Data Ascii: PNGIHDROwIIDATx:slgym{ll=mmf^A1zhgi:ZM5@YFohU9Bsh<=~b'5l`Vzb5E8fC[lSzIcIXr:.xY}+h^G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49775	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	655	OUT	GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2146 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Thu, 12 Mar 2020 10:15:57 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5e6a0bdd-862" X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: acUBlufb2mmBHuUXdand8pG8olzP4MTmLb1HYu-yH1m5tWkD5dR_lA== Age: 1485895
2024-01-15 23:16:16 UTC	2146	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 46 00 00 00 1a 08 06 00 00 00 0a 62 2a 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 f7 49 44 41 54 78 01 ed 59 0d 70 54 d5 15 3e f7 be f7 96 b0 09 91 90 84 1a 13 65 19 a5 ad 96 66 00 2b 28 54 c9 4c 06 04 4b 69 5a 0b f9 d9 8d 04 d3 80 60 d5 da b1 63 3b 76 20 99 b6 d8 b1 d3 b1 83 75 c4 88 4d 82 bb 9b 68 a6 94 aa 80 18 a7 a4 02 05 44 4a eb 0f 52 51 a0 0a 2d 3f 21 46 6c 42 d8 7d ef de 7e 77 cd 8b 2f 9b b7 ce db 19 98 11 c7 33 73 f7 fe 7d ef dc 73 bf 7b ee b9 f7 bd 65 74 91 4b 79 79 f9 95 ba ae af 3b 76 ec d8 cc ce ce 4e 93 ce 93 70 ba c8 85 1b c6 04 49 34 3d 10 08 e8 74 1e e5 a2 27 e6 42 Data Ascii: PNGIHDRFb*pHYssRGBgAMAaIDATxYpT>ef+(TLKiZ`c;v uMhDJRQ-?!FlB}~w/3s}s{etKyy;vNpI4=t'B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49776	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	660	OUT	GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3221 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:03:07 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-c95" Expires: Sun, 28 Jan 2024 18:03:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Q4Osg4vd3qh8UmSSAMGlaLyGWMhOz6zgUor6G3WePqfrEGuISpF_mw== Age: 1487589
2024-01-15 23:16:16 UTC	3221	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 1a 08 06 00 00 00 bd df d2 2f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0c 4f 49 44 41 54 68 05 ed 58 09 70 55 d5 19 3e db bd f7 bd 97 97 10 96 08 28 2a 20 2e 54 dc 06 c8 c2 b8 a0 ad 56 a7 d8 ba 94 5a ac 15 6d ad 4e 6b 88 84 22 ee ed 43 45 a7 15 4d 7c 11 bb 28 2d 4b ad 1d 1d f7 3a ad 58 ad e8 08 01 8c 58 64 b1 18 50 89 28 45 08 42 c8 7b f7 de b3 f5 3b 2f 09 26 a2 33 a5 33 b5 33 ed 3b 90 f7 ce 3b e7 3f ff f9 ff ef 5f ef 25 a4 38 8a 08 14 11 28 22 50 44 a0 88 40 11 81 22 02 45 04 8a 08 fc ab 08 d0 cf 23 ac ba 37 1e 4b 19 3f 9f 51 32 d8 5a 1b 82 ee e5 3d 3b ff fe d4 ba cc b1 f1 e7 9d 29 ae 7f 31 08 7c 86 d1 2c 85 c1 6e e6 5c dc c4 93 2c a0 dd 14 1a a6 d2 52 3d 2f 55 3c b5 a5 be e4 c3 2f Data Ascii: PNGIHDRm/sRGBOIDAThXpU>(* .TVZmNk"CEM\|(-K:XXdP(EB{;/&333;;?_%8("PD@"E#7K?Q2Z=;)1\|,n\,R=/U</

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49777	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	659	OUT	GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:16 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2344 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-928" Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: IyT5036peSBG1p27YA7zD6Ous58er1g0gotC-4NOLL-Jv9A-Y3Wk_Q== Age: 1485895
2024-01-15 23:16:16 UTC	2344	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 1a 08 06 00 00 00 d1 d9 80 2a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 08 e2 49 44 41 54 68 05 ed 58 0d 6c 14 c7 15 9e 99 dd db bb 60 c7 7f 18 8a 00 e3 bb b3 8d 4b 0f 27 6d dd c4 e0 24 c4 b5 09 a8 54 69 d3 46 95 d3 54 a4 4a 4b aa 34 41 aa 22 51 5a 94 d2 d2 a4 6d 1a aa d2 8a a6 b4 a9 42 d3 94 a8 aa 84 92 42 d2 10 a5 d4 89 15 2c 88 9d 98 56 16 16 f1 0f 77 36 38 14 c2 bf 7f ce ec ed ee 4c bf 77 3e 1f dc fa 0c 3e 47 8a 50 72 23 cd ed cc 7b 6f de cc 7c ef cd 7b 33 c7 58 b6 64 11 c8 22 90 45 e0 43 45 80 7f d0 d9 c2 b5 f5 a5 4a b1 5a a5 44 48 31 39 5b 32 6e 41 69 bf 10 da 3b e6 85 58 5b a8 b3 79 f8 83 ce f1 51 1d 3f 6d f0 df ad 69 b8 c1 10 7c 9d 64 ec 4e 83 f3 02 ce 52 55 c5 14 38 8c 75 e1 Data Ascii: PNGIHDR_*sRGBIDAThXl`K'm$TiFTJK4A"QZmBB,Vw68Lw>>GPr#{o\|{3Xd"ECEJZDH19[2nAi;X[yQ?mi\|dNRU8u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49778	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	2067	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1017 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: d7cca39c07340212 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone
2024-01-15 23:16:16 UTC	1017	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booking.com \| Official site \|
2024-01-15 23:16:18 UTC	1179	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 61 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:18 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:18 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d8cda3a0c6e60168&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsscVeI5jy-BkW_LJDWQ3dI3YusyuWANUoc x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: MMcMpnr5fdi42m-96oQfLbNQ-C41R3fL8dwbWyHeqELGTxFbpI1M3A==
2024-01-15 23:16:18 UTC	61	IN	Data Raw: 5b 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"content":"Sent","status":1},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49781	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	712	OUT	GET /static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2 HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	797	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 92724 Connection: close Server: nginx Date: Mon, 01 Jan 2024 04:37:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:49 GMT ETag: "5cadd1cd-16a34" Expires: Wed, 31 Jan 2024 04:37:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ver6haePrE1RwKJOY6aVRdxNjyZg043gW9vx4Y8t09lvrmOuUVcoIw== Age: 1276736
2024-01-15 23:16:17 UTC	15587	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 6a 34 00 0f 00 00 00 03 25 c0 00 01 69 d4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 5a 1b 20 1c de 0a 06 60 00 85 76 11 08 0a 8b 8f 4c 88 d5 69 0b 92 10 00 01 36 02 24 03 92 0c 04 20 05 83 7b 07 aa 5f 5b c6 7e 72 c3 62 70 bb 07 25 74 1b 02 d4 9f 62 6a ce f5 bb 2f 18 c7 26 71 db 9a 03 5f 9a 21 77 a0 62 ba cd 07 79 1c c0 90 7e 7f 64 ff ff ff f9 49 23 c6 b6 1d ba dd ff 83 10 d8 ab 6a 14 15 49 6c 71 4a 0a 54 6a 2b 94 2a e3 94 9c 63 42 89 84 cb c5 65 56 cb cb d2 42 e1 23 5c b7 eb 67 bf 4d 1d d3 d9 ad 37 f4 3b e6 c7 d8 1e a8 fc 7c 85 55 a1 14 ca 91 e4 d8 9c fc 16 be 36 be 2d bd 97 0e d5 bd a1 36 14 94 55 39 a1 e0 bb 95 e5 07 15 cb 47 9b a9 d0 84 ef 41 5d eb 62 d1 d5 77 91 b0 98 9d Data Ascii: wOF2j4%i?FFTMZ `vLi6$ {_[~rbp%tbj/&q_!wby~dI#jIlqJTj+*cBeVB#\gM7;\|U6-6U9GA]bw
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 41 d8 54 23 10 41 29 44 6f 36 7b f2 72 07 a2 2e ba 3a b6 e8 81 02 f5 06 52 30 c0 10 0e 2b 37 30 7d 20 8b bd 75 5c 2b 07 e8 76 19 89 c0 02 91 ac 62 4a de 05 7c fa f5 b8 83 ea 63 ee 02 95 61 4a 6e 80 e5 d2 9d 77 71 f0 02 ed d7 67 25 a0 21 13 ba bc 0f e4 09 99 76 59 76 e5 1c 1b 44 ac 1b a9 0b 60 54 87 b7 6e ba e5 26 c1 35 a7 93 d9 0e 13 99 8c 38 5c b4 a8 40 f6 f0 2f 0d 23 f9 c3 4d fe 05 aa 9c c7 b3 3b 64 04 59 5b 64 d1 13 32 fa 3a c8 3e 57 40 63 da 73 e6 16 58 95 fb 14 90 bf a8 39 cb 0c f4 65 b0 20 bb 10 bd f1 c1 63 44 2d 99 b3 7c 20 02 f4 22 18 4f 4f 09 17 7a 6b 90 7e f0 c5 3c a4 dd 66 1b 57 2e 8a 69 6a 06 54 42 9e 3b a2 3e d9 75 b2 78 2e 4d 51 3f 97 6b e1 f3 f0 28 23 43 63 41 1e dd 2c 08 81 89 90 5d da cf 37 d9 63 32 50 b9 1a 2e aa 42 fa 11 49 33 6f 8d bc Data Ascii: AT#A)Do6{r.:R0+70} u\+vbJ\|caJnwqg%!vYvD`Tn&58\@/#M;dY[d2:>W@csX9e cD-\| "OOzk~<fW.ijTB;>ux.MQ?k(#CcA,]7c2P.BI3o
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: da 8f 41 02 41 36 71 ba 35 e5 2a 63 e0 0b 77 25 c1 7a a1 61 8d e5 87 9a 9e 44 fc fa 46 4d 0a b0 b9 00 60 49 82 14 0f c1 0e a7 82 a3 37 6b 77 b3 ab 19 54 5b 7f b2 1b 94 5a db 90 ee 16 5c c8 95 06 b0 28 8b ac e3 a1 52 ff 0f ab 54 8a a1 d8 a0 ba 27 ee 2e d0 18 4e b8 26 41 39 4c 44 39 45 7f 68 dc fc d8 04 df 1a 5d 11 9c f5 86 45 70 af da 94 b2 47 ff b6 60 81 4a fc ef 98 82 ce 2b 96 57 50 6e 1c 76 41 6e 69 1b 90 71 b6 36 9e 46 c3 3f d2 c5 b6 cc d9 99 63 00 7a 9a d3 33 ac 48 3b 81 7b f4 0c fa 5a 60 4c 38 1f 3a 3b 55 dc 71 76 55 90 93 75 30 d9 a4 3f fc 05 ad 8b 1c 96 07 48 f8 84 23 19 de 95 d5 35 9a 51 ac 30 cb aa 11 5a 4e 83 10 ad de 15 e9 c4 2d 99 dd c5 cd 46 27 c1 a2 9c 36 3d da fe 24 90 c2 52 43 98 34 28 25 f2 c1 97 c7 94 01 93 69 78 ba b0 6d cb fe 5c 7d a6 Data Ascii: AA6q5*cw%zaDFM`I7kwT[Z\(RT'.N&A9LD9Eh]EpG`J+WPnvAniq6F?cz3H;{Z`L8:;UqvUu0?H#5Q0ZN-F'6=$RC4(%ixm\}
2024-01-15 23:16:17 UTC	15878	IN	Data Raw: 02 c6 aa 01 b5 8d 21 7e 94 b4 f2 d1 6c f8 0b c5 dd b5 ac c5 07 82 65 f5 7f 00 90 20 20 99 fc 3c dc 1c 5c 70 40 c1 24 84 18 37 da 6f 1a 6f 3c 23 3d b3 37 6d 9b 54 d6 a3 36 b4 6c 0a 18 fc 7b 2e 3f 15 2c 23 11 72 19 ee 70 45 5d 58 10 2f c3 8f e2 dc f8 e3 bb 9e fe 17 82 f2 df ed 9a a0 bf c1 8f cd 0b 59 81 b5 e4 68 91 10 1c 20 b8 8a 49 77 cc ea ee ad 65 0f 6a 19 a7 ae ac c0 bf d2 88 5e 60 8a 5e fc ab 24 d8 2e de 3d 0c dd 0d 1e 5a d9 95 3d be 49 37 c6 89 46 cd b7 20 62 67 81 d9 03 62 f4 c2 b1 c0 18 73 d7 60 e7 31 86 7b b0 6e 65 a9 dc 34 e4 91 31 a9 56 fd d5 e4 cc 4e 70 71 1b e2 d8 d2 02 4e 98 9f 4c 92 04 71 4d 15 14 81 4e 12 80 c4 90 53 24 da 03 ad 14 b6 06 f6 c0 e9 63 56 6d 19 71 22 10 2a d3 dc 0b 0f 8d 31 b5 5b 95 e7 5e bd 02 c2 3f 4d 6a 41 64 3f e5 bb a6 cd Data Ascii: !~le <\p@$7oo<#=7mT6l{.?,#rpE]X/Yh Iwej^`^$.=Z=I7F bgbs`1{ne41VNpqNLqMNS$cVmq"*1[^?MjAd?
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 20 9a d9 48 5c 1e e5 59 4e 1e d7 2d cf 72 b3 6e b4 7f 09 40 2a 23 4b 79 23 a5 cc 12 7e 09 68 07 da 9b 94 f2 4a 66 09 a3 79 25 fc 60 6d 21 c7 c7 99 79 50 e0 15 78 e1 d5 78 33 1c c2 58 a4 4e c9 22 82 9a 71 2a 81 2a a5 cc 32 94 52 1b 7a 9b 00 6e 21 f0 64 57 c2 89 13 0e fc 06 33 cc b0 0c c7 32 7b 33 d1 36 d9 38 19 d4 2e a1 b6 8f fd 71 24 ac a2 32 35 a5 6f c2 f0 cb 1f a9 c9 fe e4 92 c5 9c 3b d4 a3 1c 7e 33 59 ce 22 2d ff 51 d2 7b a6 7b 25 5e ee 55 e4 82 1f cd 80 d1 0b da 2f 4e 06 50 0a d1 47 09 df b2 04 f8 a2 23 2f f5 06 b5 4b 88 7a f0 e4 22 88 c2 b6 80 3f 69 8b ba 6a de c9 3c 4e 69 62 16 d4 bd 02 50 30 f8 67 3b 34 f1 59 e0 66 75 eb b1 85 e8 45 0b e6 bf 26 29 e3 65 7d a0 dd be c3 3f 76 23 f3 26 2e fe a8 2c d5 cf 6c 20 5c 8b 68 77 03 c4 da 6a 66 41 10 8a f5 fa Data Ascii: H\YN-rn@#Ky#~hJfy%`m!yPxx3XN"q*2Rzn!dW32{368.q$25o;~3Y"-Q{{%^U/NPG#/Kz"?ij<NibP0g;4YfuE&)e}?v#&.,l \hwjfA
2024-01-15 23:16:17 UTC	12107	IN	Data Raw: ba 94 db e3 d6 ba 08 5a 2e 4d 4e 41 7b 02 30 e4 01 bc 94 d6 36 2f 7a 9d 07 dd 86 3f 82 bf ec 49 49 46 7b 49 4e 5b 3d e8 94 7f 7f 82 a9 9e c5 f2 3f 46 45 23 79 17 8c b9 17 36 4c aa a3 9a 38 14 17 15 83 77 60 4f 8d ca 97 9a 9a 66 a2 ae 54 34 81 46 a7 5d 62 d6 75 37 46 a1 c4 c6 6e 61 89 ae 28 38 e1 66 6e ea 1e 59 67 dc 29 ac 5b 04 ae bb 31 bd 77 c9 ee 0d 66 d7 9d d9 8b 6c cc c0 17 7e 19 1e 3a 2e 5a 70 c8 ff f8 44 18 5e 3b 00 c3 c3 05 ce e4 d4 d9 48 ec 23 d9 16 90 80 d9 e3 d4 20 19 35 3c 08 e7 ad d9 f7 a8 f2 a9 be e4 3c 3a fb 72 56 70 f6 3c 1c 08 d8 b3 3f 28 81 31 38 1f 65 d5 29 21 8e 11 15 dd 27 8e ab ec 4f 46 84 6d fd 90 79 87 59 f9 d9 51 f6 3a f6 49 3d 26 9e 3f 9f 2e fe f1 3f b3 1a 81 ad 9b e7 64 39 1c f7 fa af 87 57 f8 4c 31 74 66 d3 d6 55 b5 0b 5a fd 50 Data Ascii: Z.MNA{06/z?IIF{IN[=?FE#y6L8w`OfT4F]bu7Fna(8fnYg)[1wfl~:.ZpD^;H# 5<<:rVp<?(18e)!'OFmyYQ:I=&?.?d9WL1tfUZP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49780	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	2621	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-01-15 23:16:17 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:17 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=43e0a3a0978700dd&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ_lHA9viw4UF8fA1YvqIDNCJjSqqyICqs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 1448f69604d5be1f9c9f0c64cfa90594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: xhqrX07ktVqYUYeNc0KnXlORpgTTk6DDxbl4WS67RNLX_VM0uiDDAw==
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49779	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:16 UTC	631	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:17 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d356bd20059c-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 33323 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:16:17 GMT Last-Modified: Fri, 17 Nov 2023 13:57:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: ob922d7d+ASp0GKFkXU4wA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: ba516809-801e-007c-3a5e-19177c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:16:17 UTC	467	IN	Data Raw: 31 39 64 32 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 31 30 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 65 61 39 Data Ascii: 19d2{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea9
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 62 61 6c 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 61 6c 22 2c 22 61 6d 22 2c 22 61 6f 22 2c 22 61 71 22 2c 22 61 72 22 2c 22 61 73 22 2c 22 61 75 22 2c 22 61 77 22 2c 22 61 7a 22 2c 22 62 61 22 2c 22 62 62 22 2c 22 72 73 22 2c 22 62 64 22 2c 22 62 66 22 2c 22 72 77 22 2c 22 62 68 22 2c 22 62 69 22 2c 22 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 73 62 22 2c 22 62 71 22 2c 22 73 63 22 2c 22 62 72 22 2c 22 62 73 22 2c 22 73 64 22 2c 22 62 74 22 2c 22 73 67 22 2c 22 62 76 22 2c 22 62 77 22 2c 22 73 68 22 2c 22 73 6a 22 2c 22 62 79 22 2c 22 62 7a 22 2c 22 73 Data Ascii: bal","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","sb","bq","sc","br","bs","sd","bt","sg","bv","bw","sh","sj","by","bz","s
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 6c 22 3a 22 65 6c 22 2c 22 65 6e 22 3a 22 65 6e 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 73 2d 41 52 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 3a 22 72 6f 22 2c 22 68 65 22 3a 22 68 65 22 2c 22 64 61 22 3a 22 64 61 22 2c 22 74 72 22 3a 22 74 72 22 2c 22 6e 6c 22 3a 22 6e 6c 22 7d 2c 22 42 61 6e 6e 65 72 50 75 73 68 65 73 44 6f 77 6e 22 Data Ascii: l":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"es-AR","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"BannerPushesDown"
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 65 2c 22 47 6c 6f 62 61 6c 22 3a 66 61 6c 73 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 42 6c 75 65 20 64 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: e,"Global":false,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Blue decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-01-15 23:16:17 UTC	675	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"CookieV2VendorServiceScr
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49782	13.32.208.58	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	528	OUT	OPTIONS /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	2780	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:17 GMT access-control-allow-credentials: true access-control-allow-headers: content-type access-control-allow-methods: POST access-control-allow-origin: https://www.booking.com access-control-max-age: 1728000 set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImRkY2QzZDNlLWQ3NGMtNGE5Ny05ZTk0LWU3OTk1MmZmYzBjMyJ9fQ; domain=account.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=43eda3a043a4000e&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7aR_OIWgQIXzNaUZXm0E6T0OpIW8TMd37k content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=43eda3a043a4000e&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7aR_OIWgQIXzNaUZXm0E6T0OpIW8TMd37k; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-ks48QHHPfoEHIuj' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 c396de17c1b5d58233088e40dd170cf4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: Tj_k7RX00783agKiMPzT8OiJOXImTYy0O2k42SGlvz_CVW3LXtS2ow==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49785	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	1327	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605681 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-01-15 23:16:17 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:17 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:17 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dc16a3a0caf10127&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKz9zS-t2jODIudj6fg1ZrCFrLa1NO14KNI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: lw4k6UYop11myHpmdz7NiVUilcr0WN4Dl7AL2rPrGy8jg3lihgOGLA==
2024-01-15 23:16:17 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49793	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	450	OUT	GET /xdata/images/xphoto/540x405/292056369.webp?k=358d8cd9ede268c8a9660de4debc48b68fe5777bddce07972ac30ae28ab8b8f2&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:26:53 GMT ETag: "1f14817c780d1c1b251591b8136e75e4c103f32f" Content-Language: 28618 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: dctnMb_J2C2ZsOnYy9uBh8o1KI2ZqsM9Ead4nRkhmPh5P0dNuLADWQ== Age: 2112564
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 36 33 65 32 0d 0a 52 49 46 46 c2 6f 00 00 57 45 42 50 56 50 38 20 b6 6f 00 00 d0 d8 01 9d 01 2a 1c 02 95 01 3e 6d 32 94 47 a6 24 22 a1 a6 55 fb 60 c0 0d 89 65 6d c4 b9 39 23 77 a6 80 2d 00 41 8a 22 49 50 cb 20 81 4e 7b 46 f6 f5 d5 78 c1 dc 93 22 94 57 da 75 d0 be 2b ea cd 6b f5 c7 de c4 95 f2 6f 95 3f 5a 97 4f 2f 79 db f5 07 9b 3f fb 7e c8 f0 71 bf 6f 75 b7 79 fa 2f 95 66 2d e7 3d 7c f9 7c f8 df f1 1e df 5f 9e 67 7f e4 7f bc f3 43 ec e7 f4 ff c7 7b 60 fe ef c0 bf 9a 7a 8b fb a3 c2 57 77 b7 03 fe d3 d0 9b e1 3f c5 79 ea 7d 8f ed 67 ad 7f 66 3d 81 3f 5c 7d 3a ff a5 e3 39 f8 1f f7 df b7 7f 01 3f d6 bf c5 7f f2 f6 84 ff 2b ff d7 a1 cf d9 7f da f4 f2 7b 5b fd af ff ff eb 4a 48 e0 a5 fa 8e 6e 34 a6 cb b0 76 17 00 48 cf 22 61 66 f8 d2 d2 65 6d 76 5e 7e bc b5 3a Data Ascii: 63e2RIFFoWEBPVP8 o*>m2G$"U`em9#w-A"IP N{Fx"Wu+ko?ZO/y?~qouy/f-=\|\|_gC{`zWw?y}gf=?\}:9?+{[JHn4vH"afemv^~:
2024-01-15 23:16:17 UTC	9194	IN	Data Raw: 0a b7 1a 8c 71 14 87 0f d6 83 2c 42 f9 90 e6 0d df 8a 42 8e 4e 9b 78 9a 9d 12 81 f1 72 4c e1 5a 50 eb 4d 83 c1 c8 7a 93 f1 a5 5b 31 e9 21 d2 4c 0c 48 80 3a 88 c8 f6 c1 81 97 84 33 1d e8 01 4a fe 42 39 10 47 0c 1e 29 cb 3b 1a e7 0b e7 73 47 94 c0 dd 0a 35 28 cf 45 cb e4 dd 0d 02 b9 ee 73 ac 4b 47 f1 13 54 ef 13 5d a2 c1 f7 55 f2 01 c8 b3 c9 93 43 38 fa 37 6f db fb a7 3c 9c f2 01 da 68 32 c6 e8 14 ab 89 03 e6 67 8c 97 fc eb 00 65 b9 19 37 07 e8 30 ab 0d 21 6c 74 11 1a 05 9a dc c7 e1 e7 4e 0d 4f d7 05 e1 f5 c5 05 e6 27 a0 0b 8e 41 c1 b3 e6 59 69 49 c9 61 fd ea ce 83 53 d3 3c 5d a9 4f 94 af c7 32 d1 34 47 ec 5c f2 b7 7a 0f e9 0c 2b 36 0d 9c 48 05 2f d6 d6 15 d9 7b fd d4 d0 7d 3d f6 7a e8 fb 6f e1 bd c6 43 ac 49 92 1b e6 86 d4 82 1f 26 72 1a f3 d4 a1 a4 c9 ae Data Ascii: q,BBNxrLZPMz[1!LH:3JB9G);sG5(EsKGT]UC87o<h2ge70!ltNO'AYiIaS<]O24G\z+6H/{}=zoCI&r
2024-01-15 23:16:17 UTC	3055	IN	Data Raw: 62 65 38 0d 0a 82 96 a0 39 b2 d6 a0 ef 91 b4 27 b6 80 c3 1c 1d a5 a1 32 2b 32 99 1a 2e 39 15 11 90 af 32 19 c6 de a8 50 4f f7 cf 29 ea ce 8f fd 59 cf 3b 09 9a 2b 1a 38 bd 13 77 51 16 d4 93 c0 cf 48 c1 5d d6 7a 52 a0 5a 41 21 2e 07 85 f6 2b ed d7 bb d9 17 ac 80 12 f3 f1 e2 c7 fa f5 2f 43 fa dd d6 29 e7 51 d1 cf fe 55 55 63 a6 5e 02 b3 56 b1 4c b8 b9 08 34 66 e5 40 82 54 9a 05 b4 2a 70 82 a6 ae d7 f6 1d 17 30 b0 fa 7c e4 f2 e4 5b 64 1b 61 a4 5d ef 48 d4 9e e4 75 15 2c ba 3b 5d 29 3c 85 68 96 40 17 eb ba e5 37 f1 f7 99 5f 68 45 4d 4a 26 9a 14 33 19 e8 18 ef d0 f1 f3 a8 3d 24 1b a9 1d ec 2b fe 8c 8c 7e e9 70 a2 62 92 e0 5c c2 c1 60 80 5c b2 5d d9 f0 79 6e bb f0 5e a2 5d 6d 3e ca 00 c7 d6 dc 42 b6 23 69 59 89 64 28 99 91 ad 19 aa 8f e4 41 f7 72 a2 03 ee f4 50 Data Ascii: be89'2+2.92PO)Y;+8wQH]zRZA!.+/C)QUUc^VL4f@T*p0\|[da]Hu,;])<h@7_hEMJ&3=$+~pb\`\]yn^]m>B#iYd(ArP
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49789	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.b1e38981.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 29425 Connection: close Last-Modified: Wed, 10 Jan 2024 14:05:32 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: rfWGFBP5n6BWYJDinfdcSl_2OOTA_hqe Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 14:53:49 GMT ETag: "1ae2718204931910384cc8792451c25f" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: QRkT7grx6dZejtzPM1dGqtLsgKssT4t20eFQNM8haBNTsNgnGHd-4g== Age: 30149 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	15990	IN	Data Raw: 76 61 72 20 62 57 65 62 53 68 65 6c 6c 43 6f 6d 70 6f 6e 65 6e 74 73 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 22 34 65 64 62 62 63 38 61 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 63 3d 7b 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 46 6f 6f 74 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 31 64 61 35 66 33 32 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 39 32 39 62 62 36 61 31 22 29 7d 7d 29 29 7d 2c 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 48 65 61 64 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 Data Ascii: var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e(
2024-01-15 23:16:17 UTC	13435	IN	Data Raw: 26 28 6e 75 6c 6c 3d 3d 3d 71 7c 7c 76 6f 69 64 20 30 3d 3d 3d 71 7c 7c 71 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 49 28 6e 29 26 26 4e 2e 61 70 70 65 6e 64 28 6e 2c 65 29 7d 29 29 29 3b 72 2e 65 74 53 65 72 69 61 6c 69 7a 65 64 53 74 61 74 65 26 26 4c 2e 61 70 70 65 6e 64 28 67 2c 72 2e 65 74 53 65 72 69 61 6c 69 7a 65 64 53 74 61 74 65 29 3b 42 26 26 4e 2e 61 70 70 65 6e 64 28 22 73 65 73 22 2c 42 29 3b 72 65 74 75 72 6e 20 4e 2e 73 65 74 28 22 6e 61 6d 65 73 70 61 63 65 22 2c 6c 2e 73 6c 69 63 65 28 2d 6f 29 29 2c 7b 75 72 6c 3a 74 2b 22 3f 22 2b 4e 2e 74 6f 53 74 72 69 6e 67 28 29 2c 68 65 61 64 65 72 73 3a 4c 7d 7d 28 65 2c 6e 29 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 5f 5f Data Ascii: &(null===q\|\|void 0===q\|\|q.searchParams.forEach((function(e,n){I(n)&&N.append(n,e)})));r.etSerializedState&&L.append(g,r.etSerializedState);B&&N.append("ses",B);return N.set("namespace",l.slice(-o)),{url:t+"?"+N.toString(),headers:L}}(e,n);return window.__

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49786	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	589	OUT	GET /psb/capla/static/js/dc32f6b7.e488df59.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 330518 Connection: close Last-Modified: Thu, 11 Jan 2024 05:17:01 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 4QqXET2PGje_M65PR6.7derRf7iku828 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 14:53:53 GMT ETag: "47728c183edababb28231c44f6f5e148" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 0wBJResuXC2dg8JUmryy5KrYaNFh1AxYZYbWidcaOtpanedNih_pOg== Age: 30145 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 64 63 33 32 66 36 62 37 2e 65 34 38 38 64 66 35 39 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 63 33 32 66 36 62 37 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 Data Ascii: /! For license information please see dc32f6b7.e488df59.chunk.js.LICENSE.txt /(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["dc32f6b7"],{d0989236:function(e,n,t){"use stri
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 68 74 74 70 73 7c 68 74 74 70 29 3a 5c 2f 5c 2f 2f 2e 74 65 73 74 28 72 29 3f 72 3a 64 2e 6f 72 69 67 69 6e 2b 72 29 3b 74 26 26 65 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 61 70 70 65 6e 64 28 22 75 6e 72 65 61 64 22 2c 22 31 22 29 2c 63 2e 65 76 65 6e 74 42 75 73 2e 70 75 62 6c 69 73 68 28 76 2c 7b 75 72 6c 3a 65 2e 74 6f 53 74 72 69 6e 67 28 29 7d 29 7d 65 6c 73 65 7b 76 61 72 20 65 3b 63 6f 6e 73 74 20 6e 3d 6e 75 6c 6c 3d 3d 3d 28 65 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 7c 7c 6e 75 6c 6c 3d 3d 3d 28 65 3d 65 2e 42 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 65 6e 76 3b 6e 26 26 6e 2e 66 65 5f 62 61 5f 6c 69 6e 6b 5f 63 61 70 6c 61 26 26 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d Data Ascii: https\|http):\/\//.test(r)?r:d.origin+r);t&&e.searchParams.append("unread","1"),c.eventBus.publish(v,{url:e.toString()})}else{var e;const n=null===(e=window)\|\|void 0===e\|\|null===(e=e.B)\|\|void 0===e?void 0:e.env;n&&n.fe_ba_link_capla&&(window.location.href=
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 74 3a 22 74 65 72 74 69 61 72 79 2d 69 6e 68 65 72 69 74 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 58 2c 61 74 74 72 69 62 75 74 65 73 3a 51 28 51 28 7b 7d 2c 65 29 2c 7b 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 6f 7c 7c 6e 2e 6e 61 6d 65 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 70 72 6f 66 69 6c 65 22 7d 29 7d 2c 74 3f 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2e 41 76 61 74 61 72 2c 51 28 7b 7d 2c 67 2c 7b 73 69 7a 65 3a 22 73 6d 61 6c 6c 22 2c 61 74 74 72 69 62 75 74 65 73 3a 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 70 72 6f 66 69 6c 65 2d 6d 6f 62 69 6c 65 2d 61 76 61 74 61 72 22 7d 7d 29 29 3a 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2e 41 76 61 74 61 72 42 6c 6f 63 6b 2c Data Ascii: t:"tertiary-inherit",className:X,attributes:Q(Q({},e),{"aria-label":o\|\|n.name,"data-testid":"header-profile"})},t?a().createElement(b.Avatar,Q({},g,{size:"small",attributes:{"data-testid":"header-profile-mobile-avatar"}})):a().createElement(b.AvatarBlock,
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 65 2e 6c 6f 67 6f 55 72 6c 2c 77 72 61 70 70 65 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 2c 7b 68 72 65 66 3a 65 2e 6c 6f 67 6f 55 72 6c 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 28 30 2c 6f 65 2e 5a 29 28 6e 75 6c 6c 3d 3d 3d 6d 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6d 3f 76 6f 69 64 20 30 3a 6d 2e 6c 6f 67 6f 55 72 6c 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 6c 6f 67 6f 2d 75 72 6c 22 7d 2c 6e 29 7d 7d 2c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 6c 6f 67 6f 22 7d 2c 65 2e 6c 6f 67 6f 7c 7c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 Data Ascii: e.logoUrl,wrapper:function(n){return a().createElement("a",{href:e.logoUrl,"aria-label":(0,oe.Z)(null===m\|\|void 0===m?void 0:m.logoUrl),"data-testid":"header-logo-url"},n)}},a().createElement("span",{"data-testid":"header-logo"},e.logo\|\|a().createElement(
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 2e 37 34 2d 2e 36 32 37 6c 2e 37 35 2d 34 2e 35 2d 2e 37 34 2e 36 32 37 68 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 76 2d 2e 37 35 41 34 2e 35 20 34 2e 35 20 30 20 30 20 30 20 31 32 20 31 32 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 7a 22 7d 29 29 7d 3b 76 61 72 20 75 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 33 2e 39 31 20 32 34 43 36 2e 39 20 32 34 20 31 2e 32 20 31 38 2e Data Ascii: .74-.627l.75-4.5-.74.627h1.5a.75.75 0 0 0 .75-.75v-.75A4.5 4.5 0 0 0 12 12a.75.75 0 0 0 0 1.5z"}))};var un=function(){return i.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},i.createElement("path",{d:"M13.91 24C6.9 24 1.2 18.
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 75 6d 62 2d 6d 6f 72 65 2d 69 6e 6e 65 72 22 2c 77 69 3d 22 62 68 2d 70 68 6f 74 6f 2d 67 72 69 64 2d 74 68 75 6d 62 2d 6d 6f 72 65 2d 69 6e 6e 65 72 2d 32 22 2c 4f 69 3d 22 77 6c 2d 65 6e 74 72 79 70 6f 69 6e 74 22 2c 4c 69 3d 27 66 6f 72 6d 5b 69 64 3d 22 68 70 72 74 2d 66 6f 72 6d 22 5d 27 2c 44 69 3d 22 5b 64 61 74 61 2d 63 69 74 79 2d 74 61 78 2d 76 61 6c 75 65 5d 22 2c 52 69 3d 22 5b 64 61 74 61 2d 76 61 74 2d 76 61 6c 75 65 5d 22 2c 4d 69 3d 22 5b 64 61 74 61 2d 70 61 79 6d 65 6e 74 2d 6d 65 74 68 6f 64 5d 22 3b 76 61 72 20 42 69 2c 78 69 3b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 44 45 46 41 55 4c 54 5f 45 56 45 4e 54 5f 4e 41 4d 45 3d 22 64 65 66 61 75 6c 74 5f 65 76 65 6e 74 5f 6e 61 6d 65 22 2c 65 2e 46 49 4c 54 45 52 53 5f 41 50 50 4c 49 Data Ascii: umb-more-inner",wi="bh-photo-grid-thumb-more-inner-2",Oi="wl-entrypoint",Li='form[id="hprt-form"]',Di="[data-city-tax-value]",Ri="[data-vat-value]",Mi="[data-payment-method]";var Bi,xi;!function(e){e.DEFAULT_EVENT_NAME="default_event_name",e.FILTERS_APPLI
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 5f 6e 61 6d 65 3a 76 6f 69 64 20 30 2c 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 3a 76 6f 69 64 20 30 2c 64 61 74 65 5f 69 6e 3a 76 6f 69 64 20 30 2c 64 61 74 65 5f 6f 75 74 3a 76 6f 69 64 20 30 2c 64 65 73 74 5f 63 63 3a 76 6f 69 64 20 30 2c 64 65 73 74 5f 75 66 69 3a 76 6f 69 64 20 30 2c 6e 69 67 68 74 73 3a 76 6f 69 64 20 30 2c 72 6f 6f 6d 73 3a 76 6f 69 64 20 30 2c 74 72 61 76 65 6c 6c 69 6e 67 5f 66 6f 72 5f 77 6f 72 6b 3a 76 6f 69 64 20 30 2c 74 6f 74 61 6c 5f 73 65 61 72 63 68 5f 70 61 67 65 73 3a 76 6f 69 64 20 30 2c 70 65 72 63 65 6e 74 5f 70 6c 61 63 65 73 5f 75 6e 61 76 61 69 6c 61 62 6c 65 3a 76 6f 69 64 20 30 2c 73 65 61 72 63 68 5f 70 61 67 65 5f 6e 75 6d 62 65 72 3a 76 6f 69 64 20 30 2c 72 61 74 65 5f 63 6f 6e 64 69 74 69 6f 6e 3a 76 6f 69 64 20 Data Ascii: _name:void 0,country_name:void 0,date_in:void 0,date_out:void 0,dest_cc:void 0,dest_ufi:void 0,nights:void 0,rooms:void 0,travelling_for_work:void 0,total_search_pages:void 0,percent_places_unavailable:void 0,search_page_number:void 0,rate_condition:void
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 6e 7d 3a 20 68 61 6e 64 6c 65 72 20 66 75 6e 63 60 29 3b 65 6c 73 65 20 68 69 28 60 24 7b 47 6e 7d 3a 20 68 61 6e 64 6c 65 72 20 66 75 6e 63 20 74 79 70 65 60 29 3b 65 6c 73 65 20 68 69 28 60 24 7b 47 6e 7d 3a 20 65 6c 65 6d 65 6e 74 20 69 64 65 6e 74 69 66 69 65 72 60 29 3b 65 6c 73 65 20 68 69 28 60 24 7b 47 6e 7d 3a 20 65 6c 65 6d 65 6e 74 20 69 64 65 6e 74 69 66 69 65 72 20 74 79 70 65 60 29 3b 65 6c 73 65 20 68 69 28 6a 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 46 72 28 29 7b 41 61 28 29 3d 3d 3d 64 61 2e 53 45 41 52 43 48 3f 45 72 28 79 72 2e 43 4c 41 53 53 2c 45 69 2c 62 72 2e 43 4c 49 43 4b 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 53 72 28 78 69 2e 44 41 54 41 5f 4c 41 59 45 52 2c 42 69 2e 4d 41 50 5f 43 4c 4f 53 45 2c 7b 7d 29 7d 29 29 3a 5f 69 28 53 74 Data Ascii: n}: handler func`);else hi(`${Gn}: handler func type`);else hi(`${Gn}: element identifier`);else hi(`${Gn}: element identifier type`);else hi(jn)}function Fr(){Aa()===da.SEARCH?Er(yr.CLASS,Ei,br.CLICK,(function(){Sr(xi.DATA_LAYER,Bi.MAP_CLOSE,{})})):_i(St
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 57 49 54 48 22 3d 3d 3d 72 3f 63 28 22 69 6e 5f 63 6f 6f 70 65 72 61 74 69 6f 6e 5f 77 69 74 68 22 29 3a 22 49 4e 5f 50 41 52 54 4e 45 52 53 48 49 50 5f 57 49 54 48 22 3d 3d 3d 72 3f 63 28 22 73 70 5f 70 61 72 74 6e 65 72 73 68 69 70 5f 77 69 74 68 5f 61 6e 6f 74 68 65 72 5f 63 6f 6d 70 61 6e 79 22 29 3a 76 6f 69 64 20 30 29 2c 5b 72 2c 63 5d 29 2c 76 3d 28 30 2c 69 2e 75 73 65 4d 65 6d 6f 29 28 28 28 29 3d 3e 73 26 26 5b 22 49 54 41 4c 49 43 22 2c 22 42 4f 4c 44 22 5d 2e 69 6e 63 6c 75 64 65 73 28 73 29 3f 73 3a 22 4e 4f 52 4d 41 4c 22 29 2c 5b 73 5d 29 3b 72 65 74 75 72 6e 20 74 3f 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 61 28 29 2e 46 72 61 67 6d 65 6e 74 2c 6e 75 6c 6c 2c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 59 72 2e 45 Data Ascii: WITH"===r?c("in_cooperation_with"):"IN_PARTNERSHIP_WITH"===r?c("sp_partnership_with_another_company"):void 0),[r,c]),v=(0,i.useMemo)((()=>s&&["ITALIC","BOLD"].includes(s)?s:"NORMAL"),[s]);return t?a().createElement(a().Fragment,null,a().createElement(Yr.E
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 69 3d 41 6c 28 29 2c 61 3d 5f 6c 28 22 46 49 44 22 29 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 74 61 72 74 54 69 6d 65 3c 69 2e 66 69 72 73 74 48 69 64 64 65 6e 54 69 6d 65 26 26 28 61 2e 76 61 6c 75 65 3d 65 2e 70 72 6f 63 65 73 73 69 6e 67 53 74 61 72 74 2d 65 2e 73 74 61 72 74 54 69 6d 65 2c 61 2e 65 6e 74 72 69 65 73 2e 70 75 73 68 28 65 29 2c 74 28 21 30 29 29 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 66 6f 72 45 61 63 68 28 72 29 7d 2c 6f 3d 68 6c 28 22 66 69 72 73 74 2d 69 6e 70 75 74 22 2c 6c 29 3b 74 3d 4e 6c 28 65 2c 61 2c 48 6c 2c 6e 2e 72 65 70 6f 72 74 41 6c 6c 43 68 61 6e 67 65 73 29 2c 6f 26 26 79 6c 28 62 6c 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 28 6f 2e 74 61 6b Data Ascii: unction(){var t,i=Al(),a=_l("FID"),r=function(e){e.startTime<i.firstHiddenTime&&(a.value=e.processingStart-e.startTime,a.entries.push(e),t(!0))},l=function(e){e.forEach(r)},o=hl("first-input",l);t=Nl(e,a,Hl,n.reportAllChanges),o&&yl(bl((function(){l(o.tak

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49788	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.f0866eea.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 19965 Connection: close Last-Modified: Thu, 14 Dec 2023 12:49:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 0Gkt0CnTnvxOJEfeuYQEpbPR8W9fMbME Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 06:50:12 GMT ETag: "d78c34e2dbec204465921f484c1997f8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: SEI_6TRM2j5bBiaYM82dBpZY86Va-n87UZ8PcpfYSfZoj7kGtHrU6w== Age: 59166 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 76 61 72 20 62 57 65 62 63 6f 72 65 50 65 72 73 6f 6e 61 6c 69 73 61 74 69 6f 6e 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 63 63 34 63 33 37 34 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 48 6f 6d 65 73 47 75 65 73 74 73 4c 6f 76 65 43 61 72 6f 75 73 65 6c 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 62 66 39 65 62 37 61 33 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 33 30 30 65 37 66 64 63 22 29 7d 7d 29 29 7d 2c 22 2e 2f 52 65 63 65 6e 74 6c 79 56 69 65 77 65 64 50 72 6f 70 65 72 74 Data Ascii: var bWebcorePersonalisationComponentService;!function(){"use strict";var e={cc4c374e:function(e,n,t){var r={"./HomesGuestsLoveCarousel":function(){return t.e("bf9eb7a3").then((function(){return function(){return t("300e7fdc")}}))},"./RecentlyViewedPropert
2024-01-15 23:16:17 UTC	3581	IN	Data Raw: 70 6c 61 2d 73 65 72 76 65 72 2f 70 61 63 6b 61 67 65 2e 6a 73 6f 6e 22 2c 5b 2c 5b 34 2c 30 2c 30 2c 30 5d 2c 30 2c 5b 30 2c 30 2c 30 2c 30 5d 2c 32 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 34 34 65 62 36 36 32 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 33 34 36 32 64 34 63 34 22 29 7d 7d 29 29 7d 29 29 7d 7d 2c 62 3d 7b 62 66 39 65 62 37 61 33 3a 5b 22 65 61 64 37 31 65 62 30 22 2c 22 64 65 65 32 35 33 34 64 22 2c 22 64 31 36 65 39 36 33 36 22 2c 22 61 62 61 62 31 61 66 65 22 2c 22 63 34 34 64 63 62 30 63 22 2c 22 32 38 64 62 64 31 33 32 22 2c 22 34 33 61 34 64 32 30 33 22 2c 22 64 63 36 64 32 38 66 66 22 2c 22 34 Data Ascii: pla-server/package.json",[,[4,0,0,0],0,[0,0,0,0],2],(function(){return t.e("844eb662").then((function(){return function(){return t("3462d4c4")}}))}))}},b={bf9eb7a3:["ead71eb0","dee2534d","d16e9636","abab1afe","c44dcb0c","28dbd132","43a4d203","dc6d28ff","4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49787	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.00d32fb1.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 16772 Connection: close Last-Modified: Thu, 14 Dec 2023 13:44:50 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: uPh9I9M_DCP7iIJCsEXI3bsveka1kFCm Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:18:40 GMT ETag: "3d37765e3d72b91ac2fb047ba1e98c79" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec22576e88e707bf58c11e0ee75d019c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: PR6tkvdX6pxYGY71RU4fYpo4bpbcj1e0bhkhfbRvkUYsxnoBt6L0og== Age: 25058 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 76 61 72 20 62 4e 61 74 69 76 65 44 69 73 70 6c 61 79 41 64 73 4e 64 69 73 70 6c 61 79 41 64 43 6f 6d 70 6f 6e 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 22 35 39 62 34 65 65 30 36 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 49 6e 64 65 78 50 72 69 6d 61 72 79 41 64 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 31 38 63 61 64 39 35 37 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 65 32 39 31 32 65 64 61 22 29 7d 7d 29 29 7d 2c 22 2e 2f 53 65 61 72 63 68 52 65 73 75 6c 74 73 50 72 6f 70 65 72 74 79 43 61 72 64 41 64 57 69 74 68 Data Ascii: var bNativeDisplayAdsNdisplayAdComponent;!function(){"use strict";var e={"59b4ee06":function(e,n,t){var r={"./IndexPrimaryAd":function(){return t.e("18cad957").then((function(){return function(){return t("e2912eda")}}))},"./SearchResultsPropertyCardAdWith
2024-01-15 23:16:17 UTC	388	IN	Data Raw: 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6e 61 74 69 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 3b 72 2e 66 6f 72 45 61 63 68 28 6e 2e 62 69 6e 64 28 6e 75 6c 6c 2c 30 29 29 2c 72 2e 70 75 73 68 3d 6e 2e 62 69 6e 64 28 6e 75 6c 6c 2c 72 2e 70 75 73 68 2e 62 69 6e 64 28 72 29 29 7d 28 29 3b 76 61 72 20 72 3d 74 28 22 35 39 62 34 65 65 30 36 22 29 3b 62 4e 61 74 69 76 65 44 69 73 70 6c 61 79 41 64 73 4e 64 69 73 70 6c 61 79 Data Ascii: ve-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]=self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]\|\|[];r.forEach(n.bind(null,0)),r.push=n.bind(null,r.push.bind(r))}();var r=t("59b4ee06");bNativeDisplayAdsNdisplay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49795	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	450	OUT	GET /xdata/images/xphoto/540x405/288300879.webp?k=20a291605b4d1cc6c15b1ee3f9598c22ddb81a8d5ed73135330e426f8d2b9629&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 01 Jan 2024 08:45:30 GMT ETag: "295b294e3a0689b395787df4e43c129bf4669e6d" Content-Language: 31670 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: I2vDozc7XIOMycR1Xb1vnu_AxItJQLb06vi1ZJhdi1JZtkj0vUPBSw== Age: 1261847
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 37 30 36 30 0d 0a 52 49 46 46 ae 7b 00 00 57 45 42 50 56 50 38 20 a2 7b 00 00 f0 f8 01 9d 01 2a 1c 02 95 01 3e 6d 30 94 47 26 24 22 a1 a8 13 1c 78 c0 0d 89 63 07 08 6a cb 24 e1 0f b9 b4 f3 36 5d cd 78 1e 58 fc 9f e3 8c 75 bf bf e1 f7 cf 7f e1 f3 80 f6 8e f4 bf f4 7d 77 7e b3 f5 71 e9 9f ce cd bb 1b eb bb a7 81 7f bf e6 ff d2 7f c7 f0 97 ce 17 cf 3f 89 f6 ac fd 83 24 ff 03 fe 4f ed 47 a9 7f 73 b3 c7 fd 7f 7f 3f 32 bf e6 ff 39 ec 29 f9 af f5 5f f9 bf e0 3d 91 ff 33 b8 13 8b ff 89 e8 3b ef 97 df 3c f1 7f 4f cf 5f e2 7d 42 7c d0 ff cd e3 b7 ea 3e c3 5f a8 bd 23 75 07 fb 17 fc 02 a3 b3 bf da 84 a6 7f f2 64 0e 19 79 a0 bd e1 1d 9c 30 c7 34 aa 3f d6 13 b5 c1 cd 34 31 49 88 3e 18 61 86 18 61 86 18 61 86 18 61 86 18 61 85 e8 e4 d5 c2 af 41 74 bc ff 64 dc bc ff a3 Data Ascii: 7060RIFF{WEBPVP8 {*>m0G&$"xcj$6]xXu}w~q?$OGs?29)_=3;<O_}B\|>_#udy04?41I>aaaaaAtd
2024-01-15 23:16:17 UTC	12392	IN	Data Raw: 64 af f2 ca f2 78 03 b9 c3 66 56 85 a0 e6 6a e0 78 f1 91 7e 6a 46 db 76 7a 37 db 3b 6d 7a d9 29 ee b3 fc 4a 90 c0 83 f3 51 23 88 4e 24 33 71 f9 e4 aa 2a 00 50 d4 42 1d 9b 56 55 54 e5 f6 a3 1c 11 53 37 5a 5f 3b 79 43 1b 92 bf 63 ea e8 43 ca 48 35 ba a2 78 86 c5 b5 41 84 f3 f7 a9 29 95 ee a8 2f de bc 0c 23 d6 8a 13 cf 55 72 ad 77 a8 9d c7 4c e7 76 4e 8e 86 b4 2d 77 28 4d 7d 82 f5 0c 7b 47 2f eb c9 be 9a ee 31 fe 90 5b c4 ac 29 cb 81 91 64 72 ce 68 88 b1 06 96 cf fc f5 f6 fd ae b4 c0 66 6e 62 e4 58 58 db 53 98 4b 3e ef e8 74 e6 10 c8 36 54 46 32 c8 4c 47 ed fe 0e 72 e9 79 1b 88 f0 a1 e7 76 a3 5d f1 c7 d7 1b 89 55 8f 0d fc 9d a4 c7 3a 4d 51 a1 97 46 44 77 7c 51 ea 3b e0 5d 5f d3 a2 42 d6 59 3e 8c 0d 05 bd d0 77 6e 28 64 ba d0 24 c7 5f 8a 3e ae 4f 8d d0 d7 11 Data Ascii: dxfVjx~jFvz7;mz)JQ#N$3q*PBVUTS7Z_;yCcCH5xA)/#UrwLvN-w(M}{G/1[)drhfnbXXSK>t6TF2LGryv]U:MQFDw\|Q;]_BY>wn(d$_>O
2024-01-15 23:16:17 UTC	2909	IN	Data Raw: 62 35 36 0d 0a e1 ea 7c 97 64 20 e2 7e a6 18 fa c7 84 a5 ae 24 e4 02 81 b6 fb d0 6c b7 b0 c0 b7 9d 74 3f 2b f1 f4 55 ba 81 54 63 19 13 8c c4 a7 bc c1 d8 cf 6c 69 ef 18 9d 51 8b 7c a7 7b b3 93 09 e2 9e 9f 7f 7a ce be 2a 06 63 a1 a0 98 4d d7 38 5d 43 40 9f 42 a4 a1 c0 cd 21 7b e6 3d 0d 1f 61 d3 9e 54 ec bb fc 2f fd 3d 71 47 6c 85 07 90 2a 93 e7 63 bd 4c cf 48 cb 1b c4 0c b5 fe 4d 02 33 94 9f 87 7a 69 4d a5 40 99 ad c7 71 57 fb 13 50 53 c5 5d 4f 08 36 fe 80 99 de 03 88 78 a9 f2 a1 43 c6 86 48 de c9 2e 39 e7 2b 46 fd 67 5f f4 9a a6 9c cc 32 a9 bb e8 4f 7a f1 86 64 2e 06 f8 80 f9 e8 c1 33 fe 6f a0 77 9b 24 c8 4e 3b f4 b5 09 ba 1e 55 82 ac 3f ae 27 b7 88 33 1f d5 7c 24 fc 4a 21 e5 47 f0 ae 44 71 17 57 c3 2d 56 99 83 bd 69 f2 21 39 33 10 01 40 d3 06 cc 03 41 3e Data Ascii: b56\|d ~$lt?+UTcliQ\|{zcM8]C@B!{=aT/=qGlcLHM3ziM@qWPS]O6xCH.9+Fg_2Ozd.3ow$N;U?'3\|$J!GDqW-Vi!93@A>
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49800	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	452	OUT	GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Content-Language: 45792 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * Date: Fri, 05 Jan 2024 15:17:35 GMT Cache-Control: max-age=2592000 ETag: "d266b8ba8cd5636f0ef98de21b5ec6eaa2e51112" X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: jLevL0CtBtcHyEZdYjObfsApAcINwYzm9hEInjjMUnzs-pw88zHo3w== Age: 892722
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 62 32 65 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 f4 01 f4 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: b2e0JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 0f f4 07 a5 7a 37 8a 74 f1 79 a6 da 6b 36 ac b8 2a 23 94 7b e3 83 5b 4a fc ca c7 3a 51 de 47 2a 6e 59 7b 71 ef 50 c9 78 ed c7 18 35 13 41 33 be c0 41 24 e3 19 ab 69 e1 ed 46 6e 70 ab ec cd d6 86 e5 1f 89 83 54 5e c8 75 b6 b4 f6 b2 23 84 53 b4 71 cd 67 5f 4f 1d e4 8e ec b8 2c 73 c7 6a d4 1e 14 d5 1e 32 c1 10 e3 b6 ea ce bc d1 af ac 9d 56 68 f0 c4 64 0c d1 09 ab e8 f5 14 a3 4c cf 10 40 a3 92 d9 a2 93 38 c8 c1 a2 b6 bc c8 e5 a4 7d 12 af 53 29 cd 50 47 cd 58 57 c6 39 ae 24 c9 68 b8 a6 a4 53 55 95 b3 52 ab 55 5c 4d 16 01 f6 a5 f4 c5 46 87 de 9c 0e 4d 34 c9 24 56 c1 ab 31 be 6a 98 34 e5 7c 55 26 2b 16 25 4a 80 8c 1a 90 4f c6 08 cd 35 d8 31 c8 a4 d8 02 81 b7 9a a1 ab b7 97 a5 5c 30 fe ed 5d 1d 2a a6 a8 be 66 99 3a fa a5 27 b1 4b 73 cd 27 e4 1e 7d eb 14 90 b1 c8 Data Ascii: z7tyk6#{[J:QGnY{qPx5A3A$iFnpT^u#Sqg_O,sj2VhdL@8}S)PGXW9$hSURU\MFM4$V1j4\|U&+%JO51\0]*f:'Ks'}
2024-01-15 23:16:17 UTC	13032	IN	Data Raw: ca 3e de 80 0e 99 ad 1f 14 8c cd 62 bd d6 0c 7e a6 9c 7f 80 fd 51 15 35 c6 41 76 4c c0 f9 48 39 e9 4d 31 e4 fc a2 9c 00 dd 8e b4 10 d9 f6 ae 63 bd 1d 39 5f 2b c2 17 44 70 e3 cb 01 bb f5 35 cb 7d aa e1 3a 4d 27 fd f4 6b aa bb ca f8 52 e9 73 d5 e3 fe 75 c9 ed e7 3b 85 75 e2 5b 52 49 76 47 9d 80 8a 95 39 36 b7 93 26 5d 42 e8 1f f5 cf c0 f5 ae 8b c3 3b ef a7 51 3b 96 52 71 fa 57 2f 80 3a 75 ae a3 c2 99 57 56 cf 42 69 e1 65 27 53 7e 8c 9c c6 9c 55 0b a5 d5 7e 66 33 de df 07 6c 4c 70 09 02 a2 37 b7 ac 79 b8 71 f4 35 55 dd 84 8f cf f1 1f e7 4c 32 1d d8 c1 ae 7e 79 f7 3b 95 2a 4b ec af b8 d9 d2 24 9a 5b df de 4d 23 8c 74 66 27 bd 41 ae 90 35 59 46 78 07 00 54 da 06 5a f0 83 9e 83 f9 d4 1a ca e7 57 b9 c1 fe 3c 57 44 df fb 3c 5b ee 71 52 4b eb d3 b7 f2 a3 3b df 8c Data Ascii: >b~Q5AvLH9M1c9_+Dp5}:M'kRsu;u[RIvG96&]B;Q;RqW/:uWVBie'S~U~f3lLp7yq5UL2~y;*K$[M#tf'A5YFxTZW<WD<[qRK;
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49799	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	396	OUT	GET /psb/capla/static/media/bh_aw_cpg_main_image.b4347622.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	621	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 62401 Connection: close Last-Modified: Fri, 05 Jan 2024 15:15:01 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: NK1_gqSh5LuI_tyN8odLCBlL9CVWM7_o Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 19:23:59 GMT ETag: "d8c78bb4aa47ab6ae3df9d9e2fd9501e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: FIzQo2dLbPZLLB_agwVVdH8j59LdRoVVqXclvnA2UyQyg_7hK8Blvg== Age: 13938 Vary: Origin
2024-01-15 23:16:17 UTC	15763	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 ca 00 00 01 d7 08 06 00 00 00 a5 36 7c 98 00 00 20 00 49 44 41 54 78 5e ec dd 77 9c 9d 67 79 e7 ff cf fd 3c a7 4f 3b 53 d5 a5 51 b5 64 b9 c8 b8 57 24 5b c6 05 0c 36 10 92 10 b2 b0 bb 64 c3 26 bb 20 12 db a4 fc 12 3b 7d 03 49 68 af 25 9b 5f d8 38 a4 d0 1d 1b 83 c1 15 c9 36 ee 45 92 25 ab f7 3e bd 9e 39 fd b9 f7 8f 19 c9 b2 a7 3c 67 34 67 ca 99 f9 be 5f 2f 61 49 e7 7a 8e c4 d4 af ee 73 3d d7 05 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 52 7c c6 af 40 Data Ascii: PNGIHDR6\| IDATx^wgy<O;SQdW$[6d& ;}Ih%_86E%>9<g4g_/aIzs="""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""R\|@
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: c1 1a d5 a7 2c 32 f5 28 28 4f 86 f9 57 d7 e0 d9 5f 19 f2 31 c3 7a c2 dd 55 43 3e f6 4e 27 fc 0a a4 30 cd 89 d8 99 9f cf 2e 1f be f5 bb 3b 15 22 1a c8 11 71 fd 5b 2f b2 36 48 de 53 eb 85 88 14 2e 67 fb d6 f9 d5 88 c8 c4 52 50 9e 0c a6 ec 4e 60 b8 91 08 cb f0 82 e7 0f f3 d8 db 5c 4f 41 b9 48 5a 13 6f 1f e0 d7 0e 33 f1 02 20 93 0b 10 70 f3 04 86 58 46 f2 6e 1e 46 5b c6 45 64 74 5c b3 c6 af 44 44 26 96 82 f2 44 ab 5e 5f 85 e7 dd 36 7c 81 75 70 bc 5b 86 7f 7c 40 4e 27 ca c5 d2 da 17 3d f3 f3 91 96 89 64 3c 07 d7 58 5c e3 1f 81 03 26 8f 83 7f a0 16 11 79 9b 6e e8 13 99 6a 66 46 50 3e 7f 6d 39 53 45 05 17 02 23 9f 1a 58 7b 0b 73 3e 10 63 24 1e 47 47 7c 5c 0a d6 7a 56 eb 45 fd 30 cb 46 00 b2 79 17 d7 f5 70 1d ff 00 1c 30 39 5c c7 ff a6 3f 11 91 d3 0c 56 27 ca 22 Data Ascii: ,2((OW_1zUC>N'0.;"q[/6HS.gRPN`\OAHZo3 pXFnF[Edt\DD&D^_6\|up[\|@N'=d<X\&ynjfFP>m9SE#X{s>c$GG\|\zVE0Fyp09\?V'"
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: d5 39 ed 9c 3d a5 96 4b 67 ec 60 66 41 73 f4 c9 e8 30 99 b6 a0 a6 2d 87 37 eb 8b 59 5b 53 c1 8e 96 3c 0e 74 65 d0 da e7 23 6c 69 9c 5c d2 c0 99 55 7b 59 31 b9 8e 92 f4 6e 0a d3 7b c8 f0 84 46 fe ef d1 dc 30 e9 4b 50 fd 0d 84 16 bf ed 06 4e 64 b8 0d f6 de 0b f5 0f 43 a8 61 c0 c1 28 b6 14 d4 77 a5 73 fb b3 67 f2 c8 e6 99 5c b7 f0 6d be 7b ee b3 a4 b8 62 93 2c 37 04 8b f8 c4 3b 3f e6 b5 8e 45 4e a1 49 4f 20 39 23 f7 65 7e 3e f7 66 72 dd 89 bd aa 2c 60 2f 9a 7d a6 58 85 6a f1 a6 28 09 20 b9 96 22 a4 f6 3c f1 6e 11 24 45 c1 e1 af 4d a3 01 cd ee 04 c6 f5 e7 a3 27 95 8f ac a6 56 39 e2 b4 8a 7d fc bf f7 fd 83 2f 3d 71 2e 1b 1b 8a 78 71 ef 24 6e fa fb c5 fc f4 d2 27 98 55 d0 8c 3e c2 c4 51 00 59 de 00 67 54 ed e5 8c aa bd b4 f9 bd dc bf 7e 21 cf ed 99 cc 83 6f ce Data Ascii: 9=Kg`fAs0-7Y[S<te#li\U{Y1n{F0KPNdCa(wsg\m{b,7;?ENIO 9#e~>fr,`/}Xj( "<n$EM'V9}/=q.xq$n'U>QYgT~!o
2024-01-15 23:16:17 UTC	9033	IN	Data Raw: fe f2 a6 53 39 ce 38 6f 09 01 90 a9 73 bc 5d 48 e6 c2 fa bc df 73 41 51 c6 ab 90 12 e5 41 60 a7 6a bf b8 e4 c2 c0 76 a7 a0 8b ce 16 7e 24 97 3b 85 8d 9d ec 46 68 5f e4 e4 a6 f4 f9 a3 4a 61 6b 7f bc 05 21 be 0d 53 52 55 5e c9 a2 3b d5 e6 49 ca 78 ad 19 71 e5 ec 00 f7 dc 63 e7 88 3f 6f eb 56 13 c1 6b e9 07 65 03 0d 25 23 7a 9e 15 a5 78 14 4c a2 2c 84 b0 81 83 6a 4c dc 25 77 16 38 ea 14 74 d1 b9 e3 b3 80 f4 95 e0 93 41 88 8d 34 f4 3e eb 14 a6 14 20 5d 7f 0c c1 4e a7 b0 71 a8 65 d0 6a 74 0a 52 94 8c 04 4b d2 0f c8 c3 d9 42 33 b2 ed 13 e9 07 44 0d ee 58 59 b6 70 45 29 74 05 93 28 27 bd 0c b4 3a 05 29 53 46 26 a7 8f 4c bf 44 39 ae af 9d f4 fe 64 21 4e 60 69 ff cc ce 9d d3 6b 0c 9e 72 71 b4 6c 3e 8c e4 cb 20 52 7b 3a 27 81 ac 47 c4 55 fb 85 32 3e 52 ae 4b bb 2d Data Ascii: S98os]HsAQA`jv~$;Fh_Jak!SRU^;Ixqc?oVke%#zxL,jL%w8tA4> ]NqejtRKB3DXYpE)t(':)SF&LD9d!N`ikrql> R{:'GU2>RK-
2024-01-15 23:16:17 UTC	4837	IN	Data Raw: 9f b6 a5 97 29 97 95 29 b9 6e c8 3a b3 fb 2c 64 e6 ad 3f 49 84 95 92 32 3b c2 31 50 21 db 1a 90 8d aa 43 14 e2 66 7f 79 93 d9 61 b4 01 d2 52 88 6d b0 a1 b4 c1 46 a0 2b 48 8a b2 99 52 bd cb 27 f5 52 94 ba 39 22 d2 75 a3 d1 b9 08 74 c5 9c 5b c5 c9 57 5d a4 b9 59 51 e7 80 fd 07 7a d1 e6 c6 d3 de b9 a6 12 9b 9e d8 60 60 0f 1c 3a cf d5 dd 0d ab 2f b0 e9 bd 6d 7b dc 78 a5 81 5d b0 79 ab 61 e7 ce 5e 98 eb ed 18 ab a5 78 23 8f e7 d4 b1 b8 0f 98 b3 10 b7 8e 79 05 b0 0e 78 1c 70 85 53 a0 37 bb 8d 66 73 4f ab 2e 9c 04 78 00 b8 d5 ee 88 e6 9b ce 9d dd 01 11 39 3c aa b1 c7 73 d6 63 8c b0 03 81 5d 8a bd 5b 85 ca 97 14 ab 1f 2f 2c 0f 85 bd 87 15 6a 5a 51 0b 85 76 28 d4 02 61 aa a5 a8 06 42 25 10 66 3a 8a 38 10 52 25 44 4a 88 c7 85 e6 51 45 e6 f2 99 12 a2 8e 10 2a 21 13 Data Ascii: ))n:,d?I2;1P!CfyaRmF+HR'R9"ut[W]YQz``:/m{x]ya^x#yxpS7fsO.x9<sc][/,jZQv(aB%f:8R%DJQE*!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49791	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	450	OUT	GET /xdata/images/xphoto/540x405/281113733.webp?k=43768154acdf2261706ad890b1e6196e0b261f88de846c23d3bf5693de202238&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 30 Dec 2023 20:37:36 GMT ETag: "fade909831cdda8e557d517b4aec62b3721f38e5" Content-Language: 47044 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: J7qlnJPLjmuU_yYAW4Si3vj3b6ii6JLh4A61vjtV9OrerhH-RnRB-w== Age: 1391921
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 62 37 63 34 0d 0a 52 49 46 46 bc b7 00 00 57 45 42 50 56 50 38 20 b0 b7 00 00 10 79 02 9d 01 2a 1c 02 95 01 3e 6d 2e 92 46 a6 23 a2 a1 aa b3 3d 80 c0 0d 89 63 6c 8d c8 ae 2b d9 10 21 e1 35 a1 dc d9 f5 2b f6 48 78 5e 8f 69 e5 b7 cc be 4a 46 a7 fd 3e 10 7b f7 98 3f b3 f7 60 f6 23 cb b5 b7 bd a9 c1 d0 bb 79 df 28 fe 60 fe 8b fc 37 ed b7 9b 3e 3f bd d1 fb 9f f9 ef fb 1f e1 fe 64 7f 1b ff a7 fc ff 8c ef 7c fe 9f f6 ef d4 7f e7 ff 8e bf 9b fe 3b da 57 f4 1f f9 bf cf f8 e7 f2 0b fd ef f2 3f e9 7d c3 bf 32 fe 97 fe df fb bf ac 27 dc fe de f8 49 ed df eb ff 6d 7d 85 fd da fb bf fe 3f f2 5e ad 7f 71 e7 87 da 6f 60 af ea 9f de bd 49 ff b5 e2 e5 ea 5e c1 bf ab bd 5c bf ca ff f5 ff 1f d4 e7 eb 5f ed bf 6d 7e 09 ff 64 fd 38 80 e7 0d ee c5 71 05 65 f8 d8 65 5d 44 49 e9 Data Ascii: b7c4RIFFWEBPVP8 y*>m.F#=cl+!5+Hx^iJF>{?`#y(`7>?d\|;W?}2'Im}?^qo`I^\_m~d8qee]DI
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: dc aa 9f 5c ac 26 6a 1a e4 f8 7d 6d d5 dc 7c 90 f0 58 c2 29 5f f3 0e f5 d2 4b 62 f6 be 30 ee ad e4 62 cc c0 9b fb 1e d6 e8 39 d6 2f 0c 88 bb 4e 56 8a a1 95 57 b1 29 b4 46 14 92 aa ab 03 32 3f 4c 6b ab 36 5d 9e a1 0a f6 d3 fc 2f 9a 7c 83 4d 2e 3d 8a 0a 2f 09 89 c1 90 02 58 37 61 8e b4 2c fd 2c 57 e1 96 4d 66 31 78 91 6d 50 6d 10 ab 36 72 90 fe 50 b0 bf 93 e3 05 19 93 d8 2d 6f dc 6f 86 f6 11 e3 c6 a9 a6 dc 8b 83 8f be 07 5f 90 f5 5a ba f3 3f b6 5f 5a 91 99 d6 ed 4b 4d 70 f2 d5 06 7b e6 be e7 5d f7 69 f7 32 fb 9f df 2b 50 61 0e c3 f9 b2 35 b5 62 13 ae 31 e0 ba 10 01 d4 09 c8 5e df 4c 89 8c 7a 18 5e 9c e6 bf 3e 73 51 62 61 f7 fa 89 60 75 9f b6 45 91 7e 5a 1f 58 4c 4f 96 13 c5 11 ee d4 0e 1f 82 a6 59 4d 0e 3b 82 d2 ed 1b 30 de 4b 10 90 10 d4 de 8a 31 54 9d 76 Data Ascii: \&j}m\|X)_Kb0b9/NVW)F2?Lk6]/\|M.=/X7a,,WMf1xmPm6rP-oo_Z?_ZKMp{]i2+Pa5b1^Lz^>sQba`uE~ZXLOYM;0K1Tv
2024-01-15 23:16:17 UTC	14284	IN	Data Raw: a4 ed e8 e5 35 7a 14 da 35 7a 72 be 83 74 3d 9a 66 21 e5 f4 52 8e a5 d9 f5 a7 4b e5 1a d9 1a 5d e4 35 c8 4c 5a 02 7c 69 65 85 13 5a db 77 d3 1b 58 4c 66 bd ff a8 be 37 40 17 06 e1 fe d2 f7 cc 5e db b2 5e 58 6e 21 4b 61 45 25 f1 84 14 42 0d ac ca ab cc 49 53 af ac 47 8d 9e 36 8a 38 9b 13 80 fc fc 3c 77 ed b9 8e b9 23 24 71 59 09 73 b0 13 3d cc c2 e3 b5 52 b7 bf 3b ed ed eb 26 5e 4b af 5d 8a 5c 76 46 3e 41 8a 57 13 0b 07 6c 53 01 4c 11 f1 9a 9c f0 17 52 46 59 9b c5 e4 80 c2 ba ef bf 24 cf dc 28 eb 65 e2 e7 63 ad c9 0d ef 09 99 31 33 17 61 bd 1f 33 c6 0d 0c 50 69 18 07 ba b6 13 14 51 e8 c4 9a b9 e8 be 84 8a 29 2a 0e 79 cd 6d 2c 1c 3d 3e cf c5 4c c3 68 8d d2 36 ea 67 5e 2e 04 96 c9 86 07 f9 f7 55 7b 6d 58 fa 1e f8 1b e0 00 32 3c ae 1c ba 33 53 e5 9e 4c db e2 Data Ascii: 5z5zrt=f!RK]5LZ\|ieZwXLf7@^^Xn!KaE%BISG68<w#$qYs=R;&^K]\vF>AWlSLRFY$(ec13a3PiQ)*ym,=>Lh6g^.U{mX2<3SL
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49802	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	392	OUT	GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	532	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 950 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:05 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:05:54 GMT ETag: "025b409525836b9e0913038b2556d2cf" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: wQwHF7l5uW42yx0If5VIiKCT0_m42IO54vA9XNs-dU4LI228srbwrA== Age: 25824 Vary: Origin
2024-01-15 23:16:17 UTC	950	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 48 08 03 00 00 00 62 33 43 75 00 00 00 54 50 4c 54 45 19 2f 5d d1 77 7c cb 68 6d 3e 50 77 e0 a2 a6 d9 8d 91 21 37 63 ff ff ff bd 3d 44 c4 51 58 56 49 69 2b 3f 69 69 78 96 89 95 ac 59 68 8a 4a 5c 80 35 48 70 7a 87 a2 9d a6 ba e3 e6 ec d0 d5 de b0 b8 c8 bf c5 d2 32 31 59 d3 7d 82 e8 bd bf c9 62 67 f4 f5 f7 9d dd 5e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 08 49 44 41 54 78 9c ed 56 d9 72 dc 20 10 9c 04 07 d6 e1 3e 37 09 ff ff 9f 29 98 19 d9 96 8d 94 b8 f4 e4 da ae 7d e8 5a a1 d6 d0 f4 00 00 9f c2 fd b6 c7 fc 5b f3 f3 f7 04 e4 87 cf 16 42 89 47 db 40 24 7a 22 ce 10 09 96 85 ea 4a 48 37 95 e7 7b b2 aa ec 26 b1 bd 47 14 ec 1d 05 4c 56 75 7e 4e 14 55 c4 a2 22 Data Ascii: PNGIHDRHHb3CuTPLTE/]w\|hm>Pw!7c=DQXVIi+?iixYhJ\5Hpz21Y}bg^upHYsIDATxVr >7)}Z[BG@$z"JH7{&GLVu~NU"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49792	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	444	OUT	GET /xdata/images/city/600x600/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:41:16 GMT ETag: "c2a0d68be0fd729b1f89d777aa710ab600246d6b" Content-Language: 58468 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cm7jDC-iR1Cf-eegriUHeS6oCzbueKGKnov52OYdgrToV2VJP0ybLg== Age: 1535701
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 65 34 36 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: e464JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 87 96 14 23 cc f3 81 db 9e 71 83 cd 26 52 33 64 82 77 f9 d5 09 c9 c8 20 f5 a8 c6 f8 d6 45 7c 83 8e 47 5a d0 66 92 38 46 d8 cb 90 00 c0 20 56 75 e6 1e 59 0e 4f e7 ed 54 43 43 4b 65 41 ce 72 6a c2 e0 93 9e c3 b6 2a 9c 67 f7 6b 9f ef 55 c0 41 03 d8 7b 52 1a d8 bb 9c 59 29 18 1f 38 e8 31 df da b9 f9 4e 27 90 f1 f7 bf ad 6c 31 ff 00 47 41 fe d5 62 48 e4 c9 27 07 ef 7f 5a 23 b8 4b 62 b9 b6 82 ee 1f 2e e2 18 a5 4c 8e 1d 73 de b2 b5 2f 87 da 7c f6 e2 4b 49 fe c9 23 e4 88 9c 6e 42 73 db d3 b5 6d da 10 66 5d e8 0a 60 92 0e 71 5a 72 5f a3 29 56 8a 23 80 0a e4 fe 1f d2 94 e0 99 50 9c 91 e2 9a 9f 86 ef f4 b6 6f b4 42 de 5a f4 91 06 e5 3f e1 58 ee 81 3f 84 fe 3c 66 bd fe 4b 98 98 e5 a0 b7 25 7a 09 1f eb db bd 73 3a b7 83 74 bd 49 de 5b 75 5b 49 58 06 3e 59 f9 33 81 d4 Data Ascii: #q&R3dw E\|GZf8F VuYOTCCKeArj*gkUA{RY)81N'l1GAbH'Z#Kb.Ls/\|KI#nBsmf]`qZr_)V#PoBZ?X?<fK%zs:tI[u[IX>Y3
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: ae f8 66 c6 f8 4c 25 73 18 49 48 04 7c e3 86 18 38 ee 0d 6d 02 a0 00 a0 03 d4 d3 10 e0 00 3d 70 7b f1 d6 a4 0e 07 05 79 1d f1 48 81 b0 1b 6f 1e e2 9f bf 68 e4 26 3e 98 a4 00 b3 21 c7 1d 7d ba 53 8c 87 9d a7 1f 4c 73 4c 12 a0 c8 0c 06 7d 4f 1f ce 90 ce aa 02 ef 50 4d 03 b9 21 9b 03 20 1f c1 73 48 67 ce 32 87 91 fd da 63 6e 03 be df 52 33 4b e6 80 40 59 47 b8 3d 68 b0 0a 66 5d c0 79 6b f9 0a 29 c6 43 90 30 79 ef fe 4d 14 01 f3 61 f1 35 e6 a3 23 09 25 6f 9d 95 33 9c 00 39 e9 e9 df a5 40 75 04 9a f0 46 c9 9d b1 aa aa 67 b9 27 a7 e7 9a c4 53 25 a5 d1 46 46 8d c3 8f 95 86 0a 9f 42 29 cd 39 82 fa 52 cd 82 24 20 f1 f5 ed f8 9a e4 b0 d4 75 3a e9 ef 22 7b e2 a8 14 45 6d 0a 79 84 29 00 00 3e ef 1d 09 3b ba f7 cd 53 5b eb 5b 8b 9b 89 66 21 61 3c aa 23 01 b7 d0 74 f4 Data Ascii: fL%sIH\|8m=p{yHoh&>!}SLsL}OPM! sHg2cnR3K@YG=hf]yk)C0yMa5#%o39@uFg'S%FFB)9R$ u:"{Emy)>;S[[f!a<#t
2024-01-15 23:16:17 UTC	9324	IN	Data Raw: 6f b9 24 27 78 55 1c 6d ff 00 3f ca af 1b 88 24 75 9b ee 4a 5b a0 27 93 d4 63 f4 a4 1a b1 b2 15 5f dd c3 91 20 6c 9c 91 9e fd 73 ed 56 a3 9d 63 8d 51 94 c8 c0 1d ca cb 80 69 ab 29 86 1d ca a8 f2 02 5a 46 74 eb cf 19 e3 9e bf a5 52 8e f0 ef dd bc 93 d3 18 e0 9c 9e 9f e7 b5 0c 1e 86 a0 bf 70 8b b9 1b 68 c2 8e 78 3c 1e ff 00 9d 22 cb 0a ae d8 e2 20 aa 92 e7 1d 07 f9 ed 54 d2 f3 7a 31 52 44 50 92 31 8c ef 24 fb d2 34 f1 f9 2e 08 5d ab 8c 67 81 ef f8 d1 7b 03 66 94 f7 7f bb 4c ee 48 c2 81 85 24 00 0f ff 00 ae aa dc de c7 0a f9 f9 24 1e 77 15 cf 6c 75 15 4e c6 e8 cf 14 6b 2c 43 e6 dc 03 67 01 47 a7 e9 56 27 9e cd ed 12 38 a6 29 26 e5 c9 c0 3c fa 62 9d ee 3e 6b 97 22 d5 e7 b8 88 40 64 44 72 08 c3 2e 47 b7 3e a6 a4 17 13 89 21 89 9c b6 79 6d a3 fa d4 10 59 25 b1 Data Ascii: o$'xUm?$uJ['c_ lsVcQi)ZFtRphx<" Tz1RDP1$4.]g{fLH$$wluNk,CgGV'8)&<b>k"@dDr.G>!ymY%
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49790	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	444	OUT	GET /xdata/images/city/600x600/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 29 Dec 2023 21:09:31 GMT ETag: "573504c191cc2c1f809824eea3d70a8a67bc3b26" Content-Language: 90590 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: q4iq85ak1byp_doqfquv6LtnXRY6oFiCc7dzN9OZoVeoIuGeTleUCg== Age: 1476405
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 66 39 63 61 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: f9caJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: f2 47 1b a7 b4 32 6b 6a f7 27 fd 1a 2c c9 29 ce 3e 45 e4 f3 ef c8 1f 51 55 3c 68 64 9d 92 ea 5f f5 92 9d ef ce 79 39 cf e1 e9 47 98 2d e1 66 de 54 ca 77 b3 0e a1 10 e7 ff 00 42 19 c7 fb 1e f5 7e 5d 1b ed df 0f ee 75 77 91 bc d8 ee 3e 68 c8 27 6e 42 90 07 d1 48 a9 8c 6d 69 0e 73 e6 72 47 9f 30 c6 69 38 c0 a7 ba 80 e6 9b 8e 2b b5 1e 6b dc 6e ec 9c 0c 54 91 23 4c cb 14 63 73 9e 00 1d ea 2d aa 0e 4b 73 4a ac 01 e0 1c fa d0 4c 5b be a2 cb 1b a9 c3 29 04 76 23 14 53 8b 33 0c 12 4f 3d e8 a1 31 ca 29 bb 9a f7 69 08 86 30 b2 e1 7a 98 f7 67 07 a1 39 f7 c0 ad 2b 7d 1f 7e 95 0c f1 79 52 12 03 05 2e 09 2e 4e 00 20 1c f4 5f 4e fd 6a 95 bc 31 dd 19 ee 59 84 61 48 7e 5b 2c de a0 03 c9 35 d7 69 ba c5 9d 97 82 6f 62 6c 0b bb b9 c0 52 47 cc a3 92 71 c7 07 ee f3 e8 4f be 72 Data Ascii: G2kj',)>EQU<hd_y9G-fTwB~]uw>h'nBHmisrG0i8+knT#Lcs-KsJL[)v#S3O=1)i0zg9+}~yR..N _Nj1YaH~[,5ioblRGqOr
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 29 3e cc f3 2c 68 df de 3f d3 8c 7f 9e 9d 56 97 a1 3e a3 a7 43 7b 14 72 03 0d d0 1e 51 53 f3 12 19 b3 8f 62 00 e3 fb dc e2 b7 a3 39 ba b6 66 53 4b 97 43 5f c1 b7 13 c5 e3 07 8a 5b a5 95 2e 25 03 7a b7 ca 7c b5 38 fc 48 db f9 d7 ac b6 3d 45 71 fe 1c f0 aa d8 eb 9a 8c d3 c2 10 3e d6 0d 8c 94 70 4b 0c 13 f4 53 9c 1f e5 9e d6 3b 98 6e 1a 64 68 c0 96 27 2a 48 1c 36 31 f9 70 47 e7 5e 9a aa 9e 84 7b 37 6b 90 15 04 66 a3 21 7d 6a 67 de e4 81 db f0 a8 76 31 e7 1c 56 c8 cd 8c 38 cf 5a 61 14 f2 a6 93 69 aa 44 0c 22 90 8a 7e da 36 9a 60 47 8a 29 db 69 08 a6 21 b9 a4 cd 2e 29 31 40 82 96 93 6d 2e c3 4c 02 92 82 a6 90 83 40 0b 48 4d 21 06 90 d3 10 b9 e2 8c d6 6e ad ad 58 68 76 cb 3e a1 72 b0 23 b6 d5 c8 27 27 19 e8 05 65 e9 5e 3a d0 b5 56 d8 97 4d 6f 21 7d 8b 1d c2 ed Data Ascii: )>,h?V>C{rQSb9fSKC_[.%z\|8H=Eq>pKS;ndh'*H61pG^{7kf!}jgv1V8ZaiD"~6`G)i!.)1@m.L@HM!nXhv>r#''e^:VMo!}
2024-01-15 23:16:17 UTC	14802	IN	Data Raw: 8a 78 20 d2 80 0d 17 0b 09 b4 76 a1 cf c8 7e 94 ec 0a 6b 8f 91 be 95 2d 8c f9 cb c4 2a 4f 89 75 46 3b c3 19 4f df 39 6e a7 a7 b7 ff 00 5a b1 57 ef c8 39 fc 6b 67 5b 0b ff 00 09 0e ab 82 9c ca 4e 13 e6 1d 4f 53 eb fd 73 58 e8 70 d2 7f 4a f5 a8 ff 00 09 1e 1e 26 de dd 88 fc c4 c0 86 0a 09 07 23 8e 82 b7 7c 3a 0f f6 2c 99 dd c3 0e 58 7b 2f e9 58 2e 30 ac 70 bf 50 7d ab a0 f0 e2 af f6 24 9b 70 32 fd 8e 4f 41 4e ab 16 1d 2b 7d c7 b7 e8 7f f2 03 b1 ff 00 ae 2b fc aa fe 2a a6 87 1b 7f 61 d8 ff 00 d7 15 fe 55 7c a6 3a b0 af 35 bd 59 eb c5 3b 22 3c 51 8a 79 03 15 cf c9 e3 3d 0a 37 d8 d7 c8 18 36 d2 ad c3 67 a6 30 7d e8 b8 ec 6e e2 93 14 8e eb 1a 17 66 00 7a 9a 48 a4 13 44 b2 2f 46 19 a6 21 71 49 4e a3 14 00 da 4a 7e 29 31 40 0d c5 26 29 f8 a3 14 5c 2c 37 14 62 9f Data Ascii: x v~k-OuF;O9nZW9kg[NOSsXpJ&#\|:,X{/X.0pP}$p2OAN+}+aU\|:5Y;"<Qy=76g0}nfzHD/F!qINJ~)1@&)\,7b
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 36 38 31 34 0d 0a 34 84 1d cd d7 68 c8 db fc 8f e0 2a fc b7 42 f3 c0 7a f0 00 ed 4b a8 9c 03 d8 1d df e1 58 3a 90 3f 68 38 cf 22 b5 b4 b5 27 c0 de 25 04 72 3e ce 47 fe 3f 5c dc b1 b7 3d b5 3a 69 c9 f3 f2 9e 6e df 7c d6 cf 86 d9 53 53 0c db 48 08 cd 86 e8 70 3a 56 33 ff 00 ac 3f 5a d7 f0 ea 19 35 54 40 9b f7 2b 0c 7e 06 b6 5a 8e 5f 0b 3d 0f 44 f1 6a e9 91 cf 0c 96 16 f3 ae 46 0b 8d d8 eb eb 50 ea 7e 31 6b 8d 4f 72 5b 45 14 7b 97 28 99 03 ee 81 d3 f0 aa c6 c4 9b 69 b1 6e aa dc 13 96 e7 e9 8f e9 58 93 d8 dc 1b 8c f9 3c e0 60 03 d7 8a 39 53 6d 34 73 7b 47 d0 f4 5f 30 4d e1 8d 79 fa 19 44 33 01 fe f2 7f f5 ab c3 26 e2 43 5e cb a3 4b 25 e7 86 b5 58 e6 8f 6b 7d 92 dc 28 1d c2 97 40 7f 41 5e 39 72 bb 66 71 8e 87 15 95 24 e3 a3 dc ee 93 bc 13 12 13 f3 57 61 e0 9b Data Ascii: 68144h*BzKX:?h8"'%r>G?\=:in\|SSHp:V3?Z5T@+~Z_=DjFP~1kOr[E{(inX<`9Sm4s{G_0MyD3&C^K%Xk}(@A^9rfq$Wa
2024-01-15 23:16:17 UTC	10268	IN	Data Raw: 33 9f ba 10 a1 fa 74 15 e6 f2 7c 46 d6 6e 09 16 96 90 f9 9d 00 0a 4b 7f 3f e9 54 ae fc 6f e2 50 50 4f 72 f0 c4 eb de 30 09 fa 64 73 4f d9 b7 bf e6 1c e9 6d f9 1d 77 c4 9d 3e 39 ac e0 d4 60 1b de 03 f3 b2 8e 02 12 06 0f e2 46 3e a6 bc e3 5f b8 17 77 56 f3 1e 58 db a8 6f a8 24 56 ac f1 78 ba e3 4b 69 ee 1e 7f b1 c8 9b ce f7 c2 3a 11 9e 01 3c f1 cf 4a e7 ae b0 56 dd c0 39 23 04 9a b8 46 cb d0 89 4a ef d4 e8 be 1c c7 bb c5 d6 8b b7 76 e5 90 10 7b fc 8d 5d b6 a3 e1 7b ab 7f 18 45 ae 58 dc 22 83 82 8b 2c 65 d4 1d 9b 48 24 1c fa d7 17 f0 e5 82 f8 d7 4f 27 18 2c c0 7f df 26 bd e6 e6 d5 24 5c 80 0e 46 19 7d 6a 67 74 ee 8d e8 ca 36 e5 91 c2 5e ea 26 0b 3b a8 fc 43 0c 32 d8 c8 00 77 84 13 b3 27 6e 40 3c ff 00 17 bd 79 df 8c 3c 26 34 69 13 50 d2 d9 a7 d3 25 c3 47 2a Data Ascii: 3t\|FnK?ToPPOr0dsOmw>9`F>_wVXo$VxKi:<JV9#FJv{]{EX",eH$O',&$\F}jgt6^&;C2w'n@<y<&4iP%G*
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49801	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	414	OUT	GET /design-assets/assets/v3.109.0/illustrations-traveller/GlobeGeniusBadge.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	533	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 19613 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:03 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:16:16 GMT ETag: "46a2de536918e78228ad39f6c9bced54" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: DuRmVWnIsDrNLC3sdTHL9lnIeHLkqEs3nmydYCCFhRXjiWuJM7aN4A== Age: 6224 Vary: Origin
2024-01-15 23:16:17 UTC	15851	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 04 00 00 01 04 08 03 00 00 00 f9 d6 ba 38 00 00 02 fd 50 4c 54 45 4c 69 71 bb db f5 82 8f a3 7b 86 99 fd b6 00 bf de f5 fd dd 91 b8 b1 9e a6 c7 e4 fb a5 27 7b 89 a1 7d 8a a1 8c 9f b7 ba db f4 7c 87 9b 7d 88 9d 79 85 9a af d4 f4 bd dd f5 70 79 8e fd b3 36 8d c0 f1 bc dc f5 b5 d8 f4 bb db f5 fc 9b 03 bc dc f5 a7 cf f3 2a 58 a6 76 95 c8 bc dc f5 f6 6b 00 bc da f1 0a 3f 96 ff b5 00 04 56 be 8b a7 d3 77 81 96 72 7b 90 ba da f4 72 7e 95 22 75 d4 bb dc f5 bd db f0 ba db f4 bd dc f4 fe b5 02 0e 5e c1 ff b6 00 fe de 90 03 47 a8 fe b4 04 fd dc 8d f9 87 02 bb db f5 bb db f4 ba da f4 fe b2 02 0a 58 bc ff b5 01 4c 89 d3 bb db f4 bb db f4 ff de 8f ff de 90 ff df 91 b8 d9 f4 bb db f5 26 7f e0 bb db f4 f6 6e 00 fe Data Ascii: PNGIHDR8PLTELiq{'{}\|}ypy6*Xvk?Vwr{r~"u^GXL&n
2024-01-15 23:16:17 UTC	3762	IN	Data Raw: 8c 3e 97 4d ed 9d ae 9f 76 d7 c8 5b 46 30 fc f4 3e bc 0f 9e 07 8a 8e f3 b8 60 88 bb 7f cf 50 9c a4 18 12 f6 26 70 68 3c b1 14 6b 18 ca 7a 6c a2 c0 71 22 cf 29 ae 6c 07 47 44 22 0e 9e 5b ef fd f8 83 3f c2 3e d7 85 6e c6 1c 0a d0 66 e9 59 b7 a1 4c bf d8 84 99 c6 c0 70 e3 0f ef d9 86 9e 6b a8 3d d6 cf 65 b1 39 1c fd 43 06 92 71 92 0c 34 dd 71 0a ee 12 44 ee 54 54 55 08 0b 2e 81 13 6d 42 98 13 eb 7d bc aa 7e b9 fd e0 82 9f 5c e8 5e a0 99 09 bb 05 54 13 38 c3 a4 a9 eb 7a ec cb ae d1 38 01 7d cf 88 61 a5 ff 97 0d 1e 98 8e 6e d9 e6 70 c1 41 2f d5 b1 a7 cf 00 27 04 28 d0 41 24 e3 74 1a f6 70 a2 3f 2b 88 04 ef f3 38 1c 9c 4b e5 62 1e 62 f7 82 05 dd dd dd b7 5f f0 c1 80 cc 84 5d 31 c3 6e 45 21 a1 9f d5 db 3b 69 f5 8c 6b b0 11 6f 30 16 61 45 8f 71 36 ed 21 c0 84 76 Data Ascii: >Mv[F0>`P&ph<kzlq")lGD"[?>nfYLpk=e9Cq4qDTTU.mB}~\^T8z8}anpA/'(A$tp?+8Kbb_]1nE!;iko0aEq6!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49794	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	450	OUT	GET /xdata/images/xphoto/540x405/266633264.webp?k=7f9eb9bcfb7cd9189036fd6b28f51eb2373fb877f2b10681ae8abbb7a0c63613&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 20 Dec 2023 10:11:33 GMT ETag: "fd71ca1d4ae81d5c5ce8bc184e9100bca098389a" Content-Language: 31784 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 3rCtrAmqa-ScPG_B_sEOcDrpyY15k5F8HnF7eqcNhjbWwQq5XQjitA== Age: 2293484
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 37 63 32 38 0d 0a 52 49 46 46 20 7c 00 00 57 45 42 50 56 50 38 20 14 7c 00 00 10 ae 01 9d 01 2a 1c 02 95 01 3e 6d 32 95 47 26 24 23 21 a9 56 0a 50 c0 0d 89 63 6e d7 a8 cc ac 19 26 43 97 98 18 8e 4f 29 2e f5 be d8 c9 69 39 41 bc e8 8c 36 ae 7b ea 8d de 5f f0 3e 35 ff e5 f1 af e1 bf ef f9 bb 7b 27 7b 4f fa 1e bd f9 cf fa b0 e7 71 f3 70 f4 7a ea d7 f4 5c f3 5a ff d5 ed 71 e9 81 a6 77 2e 4f 3d fb 93 e0 af 8f 0f 71 7e eb f9 15 ee 13 91 3f 7f fe f3 cc 6f b4 3f d7 ff 2b ed 73 f9 5f fb df e7 3c 65 f8 f3 fe cf f9 ff 60 bf cf 7f a7 ff c4 ff 03 eb 9f f6 9d b6 fb 37 fa 9f da ff 60 bf 77 7e e1 fb 2f fe 97 f6 a7 e2 b3 eb 7c d7 fb 4b ec 07 e5 67 fc ff 0c 3f c4 7f bc f6 05 fd 33 ea eb fe 37 ee 27 a4 ef d8 3f da fe dd fc 0d 79 6f 7f ff f7 a5 fb ad ff ff de 97 f6 93 ff f9 Data Ascii: 7c28RIFF \|WEBPVP8 \|*>m2G&$#!VPcn&CO).i9A6{_>5{'{Oqpz\Zqw.O=q~?o?+s_<e`7`w~/\|Kg?37'?yo
2024-01-15 23:16:17 UTC	15408	IN	Data Raw: f9 8c 9b fb f0 dd 24 16 0a 24 d6 24 ca 8d af f4 e5 9d 5c d0 c2 02 f1 25 61 d8 e5 af 27 80 c9 95 31 4e e7 89 d9 67 e1 5e 99 6b be 21 cf b4 b4 19 39 b7 a7 db aa ce a8 fa 1a 1c 80 21 1b fd e8 f6 9d 98 2d f7 1f b1 10 92 da 2c 8a 99 39 21 b1 b1 b2 96 bc 49 fb bf e5 a4 31 50 52 4d aa c4 f2 76 93 b7 64 6b 61 2b a2 7b 82 05 fe 10 65 89 f6 e2 f5 3a 97 e9 4e c7 9b 6a c9 64 78 a7 99 e2 55 cc b6 41 49 42 43 d1 7d e7 76 bd e3 62 45 cf 99 e2 8b fb 01 14 e4 47 4e 63 e0 82 63 6f aa 27 96 18 23 43 63 32 d0 c4 3a 29 cc 09 d0 24 ce a6 0b 16 08 6b 0f e9 ea 3b 06 cb 40 10 bc 96 f2 23 47 18 d7 63 42 ee 49 0d 1a eb eb c9 29 21 60 50 b4 e2 be 05 90 a7 84 46 6c ce 34 cc a8 4c 85 76 b4 31 1c 88 e7 8b 04 56 10 c0 4c 6c a7 1d 7f de ec 15 c7 e6 95 e2 e9 8a 2d 2a dd 6b 6d eb 08 4d a1 Data Ascii: $$$\%a'1Ng^k!9!-,9!I1PRMvdka+{e:NjdxUAIBC}vbEGNcco'#Cc2:)$k;@#GcBI)!`PFl4Lv1VLl-*kmM
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49803	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	589	OUT	GET /psb/capla/static/js/18cad957.c8e7c8d3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 34523 Connection: close Last-Modified: Thu, 14 Dec 2023 14:04:09 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: nmrPA_lRDWvl3h3NFYfwewEKG4mSScRU Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:41:56 GMT ETag: "a815e76baa21cad3e3da1f9711577fb5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: u4TFEdJezyzM-bBnP6cEvyKscbfL-8G6_rfrFKKd_vAsVuYayYCZ7w== Age: 23662 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 31 38 63 61 64 39 35 37 2e 63 38 65 37 63 38 64 33 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 6e 61 74 69 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6e 61 74 69 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 63 61 64 39 Data Ascii: /! For license information please see 18cad957.c8e7c8d3.chunk.js.LICENSE.txt /(self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]=self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["18cad9
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 3d 21 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 6e 2e 67 65 74 41 66 66 69 6c 69 61 74 65 28 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 21 74 2e 69 73 42 6f 6f 6b 69 6e 67 4f 77 6e 65 64 29 3b 72 65 74 75 72 6e 21 72 26 26 61 7d 2c 63 3d 65 3d 3e 28 65 3d 3e 7b 63 6f 6e 73 74 7b 72 65 71 75 65 73 74 43 6f 6e 74 65 78 74 3a 74 7d 3d 65 2c 6e 3d 74 2e 67 65 74 4c 61 6e 67 75 61 67 65 28 29 2e 73 74 61 72 74 73 57 69 74 68 28 22 65 6e 22 29 2c 72 3d 22 75 73 22 3d 3d 3d 74 2e 67 65 74 56 69 73 69 74 6f 72 43 6f 75 6e 74 72 79 28 29 26 26 22 6d 64 22 21 3d 3d 74 2e 67 65 74 56 69 73 69 74 6f 72 43 6f 75 6e 74 72 79 52 65 67 69 6f 6e 28 29 3b 72 65 74 75 72 6e 20 69 28 65 29 26 26 72 26 26 6e 7d 29 28 65 29 7c 7c 28 65 3d 3e 7b 63 6f 6e 73 74 7b 72 65 71 75 65 73 Data Ascii: =!(null===(t=n.getAffiliate())\|\|void 0===t\|\|!t.isBookingOwned);return!r&&a},c=e=>(e=>{const{requestContext:t}=e,n=t.getLanguage().startsWith("en"),r="us"===t.getVisitorCountry()&&"md"!==t.getVisitorCountryRegion();return i(e)&&r&&n})(e)\|\|(e=>{const{reques
2024-01-15 23:16:17 UTC	1755	IN	Data Raw: 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 74 7c 7c 65 21 3d 3d 65 26 26 74 21 3d 3d 74 7d 7d 2c 22 31 35 38 63 34 31 31 39 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 22 65 63 65 39 32 62 66 61 22 29 2c 61 3d 6e 28 22 31 37 39 66 66 63 65 62 22 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 69 3d 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 63 3d 6f 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 73 3d 72 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 72 67 75 6d 65 6e 74 73 7d 28 29 29 3f 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 61 28 65 29 26 26 69 2e 63 61 6c 6c 28 65 2c 22 63 61 6c 6c 65 65 22 29 26 26 21 63 2e 63 61 6c 6c Data Ascii: tion(e,t){return e===t\|\|e!==e&&t!==t}},"158c4119":function(e,t,n){var r=n("ece92bfa"),a=n("179ffceb"),o=Object.prototype,i=o.hasOwnProperty,c=o.propertyIsEnumerable,s=r(function(){return arguments}())?r:function(e){return a(e)&&i.call(e,"callee")&&!c.call

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49798	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	1543	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-01-15 23:16:17 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:17 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7ddca3a02f7a0065&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLcF3xEX7IfaJMJgwpvR7sYMf8VyY-kJ34 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: fZZTgK-TiR6SZW9x7EO9uovH4pI9weTD8bxtdof7kCaDsPGyb_M-WQ==
2024-01-15 23:16:17 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49797	18.165.98.45	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	569	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.edge.sdk.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	614	IN	HTTP/1.1 307 Temporary Redirect Server: CloudFront Date: Mon, 15 Jan 2024 23:16:17 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Cache-Control: max-age=86400 Location: https://d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js X-Cache: FunctionGeneratedResponse from cloudfront Via: 1.1 170caffbbbc9abe2c5fd15f4f58b75b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: Vaoe9QYUpJAoeTL9FCOyRVbvML36p8A-tAtwsNIzg7USoBvIeibMyg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49804	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	610	OUT	GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 226735 Connection: close Server: nginx Date: Tue, 02 Jan 2024 15:56:08 GMT Last-Modified: Wed, 10 Apr 2019 11:21:48 GMT ETag: "5cadd1cc-375af" Expires: Thu, 01 Feb 2024 15:56:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: i8RcA6pMB4SqAGnlLW8javacJstaM1o5yOFdCxHR_R2McoxdBc17vQ== Age: 1149609
2024-01-15 23:16:17 UTC	15588	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 62 6f 6f 6b 69 6e 67 2d 69 63 6f 6e 73 65 74 27 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 66 6f 6e 74 2d 77 6f 66 66 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 64 30 39 47 52 67 41 42 41 41 41 41 41 70 65 34 41 41 77 41 41 41 41 43 6c 32 67 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 48 55 31 56 43 41 41 41 42 48 41 41 41 4b 4e 77 41 41 43 6a 63 4e 51 77 38 53 55 39 54 4c 7a 49 41 41 43 6e 34 41 41 41 41 59 41 41 41 41 47 41 50 45 67 65 37 59 32 31 68 63 41 41 41 4b 6c 67 41 41 41 48 4d 41 41 41 42 7a 4e 66 46 48 6c 68 6e 59 58 4e 77 41 Data Ascii: @font-face { font-family: 'booking-iconset'; src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwA
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 55 4d 44 52 55 49 43 41 34 46 42 41 63 43 41 67 49 43 41 67 49 48 73 51 39 46 4a 50 78 53 4a 45 55 50 44 52 55 4f 42 77 63 4f 46 51 30 50 52 53 51 42 57 41 4a 57 4a 45 55 50 44 52 55 4f 42 77 63 4f 46 66 79 6c 57 46 5a 61 67 33 68 64 53 45 78 5a 64 6f 56 63 41 54 39 55 63 77 77 58 44 41 73 56 43 51 6b 51 42 77 59 4a 41 6a 34 42 73 67 51 4d 43 51 67 5a 45 42 41 70 47 68 6b 70 45 42 41 5a 43 51 6b 4d 41 77 4d 44 41 77 4d 44 44 41 6b 4a 47 52 41 51 4b 52 6b 61 4b 52 41 51 47 51 67 4a 44 41 51 44 41 77 4d 44 41 69 77 4d 46 41 63 48 43 41 63 49 42 78 51 4d 44 52 77 52 45 43 4d 53 45 79 49 52 45 42 30 4d 44 52 4d 48 43 41 63 48 43 41 63 54 44 51 77 64 45 42 45 69 45 78 49 6a 45 42 45 63 41 56 67 68 4b 77 51 45 4b 79 45 63 57 33 4f 45 52 67 49 42 41 51 49 42 52 Data Ascii: UMDRUICA4FBAcCAgICAgIHsQ9FJPxSJEUPDRUOBwcOFQ0PRSQBWAJWJEUPDRUOBwcOFfylWFZag3hdSExZdoVcAT9UcwwXDAsVCQkQBwYJAj4BsgQMCQgZEBApGhkpEBAZCQkMAwMDAwMDDAkJGRAQKRkaKRAQGQgJDAQDAwMDAiwMFAcHCAcIBxQMDRwRECMSEyIREB0MDRMHCAcHCAcTDQwdEBEiExIjEBEcAVghKwQEKyEcW3OERgIBAQIBR
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 63 6e 4c 67 45 31 4e 44 59 33 50 67 45 7a 4e 53 49 47 42 77 34 42 46 42 59 66 41 54 34 42 4e 7a 34 42 4e 79 63 75 41 53 4d 44 6b 65 4d 62 53 7a 41 77 61 6a 66 6a 4a 56 35 68 58 69 55 6c 4a 69 59 6c 4d 78 74 48 4a 43 56 47 47 77 6f 4b 43 52 6f 4b 4a 57 67 6c 43 68 6f 4a 43 67 72 39 6c 43 5a 47 47 73 4d 59 4f 79 49 6a 54 43 6e 43 47 78 30 64 47 78 74 46 4a 6a 46 64 4a 53 59 6c 4a 53 58 6b 4e 32 6f 77 4d 45 73 62 34 79 56 65 4d 51 46 79 34 7a 64 71 4d 43 39 4d 47 2b 4d 6c 4a 53 55 6c 4a 56 35 68 58 69 58 2b 32 78 77 62 47 78 77 4b 47 67 6b 4b 43 69 51 6b 43 67 6f 4a 47 67 6f 44 47 78 30 62 77 69 6c 4d 49 69 4d 37 46 38 49 62 52 53 59 6d 52 68 6f 62 48 55 41 6c 4a 53 56 65 59 6c 30 6d 34 78 74 4d 4c 7a 42 71 4e 2b 51 6c 4a 51 41 41 41 77 41 41 2f 38 41 46 59 Data Ascii: cnLgE1NDY3PgEzNSIGBw4BFBYfAT4BNz4BNycuASMDkeMbSzAwajfjJV5hXiUlJiYlMxtHJCVGGwoKCRoKJWglChoJCgr9lCZGGsMYOyIjTCnCGx0dGxtFJjFdJSYlJSXkN2owMEsb4yVeMQFy4zdqMC9MG+MlJSUlJV5hXiX+2xwbGxwKGgkKCiQkCgoJGgoDGx0bwilMIiM7F8IbRSYmRhobHUAlJSVeYl0m4xtMLzBqN+QlJQAAAwAA/8AFY
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 45 75 41 67 51 48 42 67 51 75 41 53 63 6d 42 67 63 47 46 42 63 65 41 7a 4d 78 4d 6a 34 43 4e 7a 59 6b 48 67 45 58 46 6a 59 33 4e 69 59 6e 42 79 34 42 42 77 34 44 42 77 34 44 4a 79 34 42 4a 79 59 47 42 77 59 57 46 78 34 42 46 78 34 42 4d 7a 45 79 50 67 49 33 50 67 4d 33 4e 68 59 58 46 6a 59 33 4e 69 59 6e 41 52 59 32 4e 7a 45 32 4a 69 63 6d 42 67 63 47 46 67 45 78 50 67 4d 33 4e 43 59 6e 4c 67 45 6e 4c 67 45 6e 4c 67 45 6e 4c 67 45 48 42 51 34 42 46 7a 45 58 48 67 45 2f 41 52 63 4f 41 77 63 65 41 54 34 42 4e 77 5a 69 42 48 58 55 2f 74 48 41 72 2f 37 73 77 47 63 42 43 68 30 4b 43 67 73 42 4e 57 57 53 58 53 35 6b 62 58 59 2b 73 41 45 55 77 47 59 42 43 68 30 4b 43 67 45 4c 78 7a 74 2b 51 53 35 65 58 6d 41 78 50 58 64 31 63 6a 63 76 57 79 6b 4e 48 41 59 47 43 Data Ascii: EuAgQHBgQuAScmBgcGFBceAzMxMj4CNzYkHgEXFjY3NiYnBy4BBw4DBw4DJy4BJyYGBwYWFx4BFx4BMzEyPgI3PgM3NhYXFjY3NiYnARY2NzE2JicmBgcGFgExPgM3NCYnLgEnLgEnLgEnLgEHBQ4BFzEXHgE/ARcOAwceAT4BNwZiBHXU/tHAr/7swGcBCh0KCgsBNWWSXS5kbXY+sAEUwGYBCh0KCgELxzt+QS5eXmAxPXd1cjcvWykNHAYGC
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 4d 44 42 41 4d 44 42 41 45 45 41 56 49 42 41 68 6b 6f 47 77 34 42 41 51 49 42 41 51 45 43 41 51 49 42 41 51 45 42 41 51 45 42 41 51 45 43 41 51 45 42 41 67 45 43 41 51 45 42 41 51 45 42 48 30 51 6a 30 77 45 43 41 51 45 42 41 67 45 43 41 51 45 43 41 51 45 42 41 67 45 42 41 51 49 42 41 51 45 42 4b 32 6f 37 41 51 45 42 49 30 49 65 44 45 49 79 41 51 45 42 41 51 49 42 41 67 45 42 41 51 45 42 41 51 45 42 41 67 45 43 41 51 45 42 41 64 4f 42 41 69 73 6b 41 51 45 42 41 51 49 42 41 51 45 42 41 51 45 42 41 51 49 42 41 67 45 42 41 51 45 43 41 64 4d 43 41 51 45 43 41 51 45 42 41 67 45 42 41 51 49 42 41 51 49 42 41 67 45 42 41 51 49 42 4e 34 6c 4c 41 51 49 42 44 41 30 42 41 41 41 44 41 41 7a 2f 77 41 5a 42 41 37 55 41 46 41 41 7a 41 46 55 41 41 41 45 6d 49 67 63 42 42 Data Ascii: MDBAMDBAEEAVIBAhkoGw4BAQIBAQECAQIBAQEBAQEBAQECAQEBAgECAQEBAQEBH0Qj0wECAQEBAgECAQECAQEBAgEBAQIBAQEBK2o7AQEBI0IeDEIyAQEBAQIBAgEBAQEBAQEBAgECAQEBAdOBAiskAQEBAQIBAQEBAQEBAQIBAgEBAQECAdMCAQECAQEBAgEBAQIBAQIBAgEBAQIBN4lLAQIBDA0BAAADAAz/wAZBA7UAFAAzAFUAAAEmIgcBB
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 41 32 41 45 59 41 56 67 41 41 41 53 4d 31 4d 7a 49 32 4e 54 51 6d 49 79 45 69 42 68 55 55 46 6a 73 42 46 53 4d 69 42 68 55 52 46 42 59 37 41 52 51 57 4d 7a 49 32 4e 53 45 55 46 6a 4d 79 4e 6a 55 7a 4d 6a 59 31 45 54 51 6d 49 7a 45 6c 4d 78 55 6a 4e 51 45 55 42 69 4d 68 49 69 59 31 45 54 51 32 4d 79 45 79 46 68 55 31 46 41 59 6a 49 53 49 6d 50 51 45 30 4e 6a 4d 68 4d 68 59 56 41 6f 6d 58 45 77 38 71 43 77 6a 2b 71 67 67 4c 4b 67 38 54 6d 43 35 44 51 79 34 6d 46 77 38 51 46 67 45 77 46 68 41 50 46 79 55 76 51 30 4d 76 2f 74 46 4d 54 41 46 56 46 68 44 39 37 51 38 57 46 67 38 43 45 78 41 57 46 68 44 39 37 51 38 57 46 67 38 43 45 78 41 57 41 74 79 59 4e 41 63 49 43 51 59 49 43 44 61 59 4f 53 2f 39 37 53 39 4d 44 68 67 59 44 67 34 59 47 41 35 4d 4c 77 49 54 4c Data Ascii: A2AEYAVgAAASM1MzI2NTQmIyEiBhUUFjsBFSMiBhURFBY7ARQWMzI2NSEUFjMyNjUzMjY1ETQmIzElMxUjNQEUBiMhIiY1ETQ2MyEyFhU1FAYjISImPQE0NjMhMhYVAomXEw8qCwj+qggLKg8TmC5DQy4mFw8QFgEwFhAPFyUvQ0Mv/tFMTAFVFhD97Q8WFg8CExAWFhD97Q8WFg8CExAWAtyYNAcICQYICDaYOS/97S9MDhgYDg4YGA5MLwITL
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 63 78 46 42 59 64 41 53 4d 54 48 67 45 7a 4d 6a 59 31 4e 43 59 6e 4c 67 45 31 4e 44 59 7a 4d 68 59 58 42 79 34 42 49 79 49 47 46 52 51 57 46 78 34 42 46 52 51 47 49 79 49 6d 4a 77 45 6e 4d 78 63 65 41 52 63 78 50 67 45 2f 41 54 4d 58 48 67 45 58 4d 7a 51 32 50 77 45 7a 42 79 4d 6e 4c 67 45 31 49 77 34 42 44 77 45 6a 4a 53 4d 56 4d 78 55 6a 4e 54 4d 56 49 78 55 7a 46 51 49 46 56 35 70 79 51 67 46 44 63 70 70 58 56 35 6c 7a 51 6b 4a 7a 6d 56 64 72 76 49 31 52 55 59 32 38 61 32 75 39 6a 46 45 42 55 6f 79 39 61 2f 58 2b 2f 52 67 74 45 52 45 4e 41 34 59 42 41 78 67 74 45 52 45 4e 41 7a 6b 57 51 68 6f 61 42 52 55 57 51 68 6f 5a 42 6e 4d 56 45 51 4d 48 41 67 45 42 41 52 45 54 45 51 4d 49 41 77 45 52 42 77 4d 4c 42 67 59 47 42 67 63 4b 44 42 41 4f 42 77 6f 44 42 Data Ascii: cxFBYdASMTHgEzMjY1NCYnLgE1NDYzMhYXBy4BIyIGFRQWFx4BFRQGIyImJwEnMxceARcxPgE/ATMXHgEXMzQ2PwEzByMnLgE1Iw4BDwEjJSMVMxUjNTMVIxUzFQIFV5pyQgFDcppXV5lzQkJzmVdrvI1RUY28a2u9jFEBUoy9a/X+/RgtERENA4YBAxgtERENAzkWQhoaBRUWQhoZBnMVEQMHAgEBARETEQMIAwERBwMLBgYGBgcKDBAOBwoDB
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 73 38 50 43 73 43 55 69 73 38 51 49 48 2b 4d 77 47 61 7a 38 75 59 33 2f 36 4a 41 55 51 6a 2f 74 2f 75 4d 38 63 56 62 30 34 4d 41 53 71 49 56 66 36 49 50 79 6f 42 34 6a 45 78 2f 66 51 48 46 52 77 44 64 43 35 2f 4c 66 33 70 6d 67 46 30 41 68 63 74 2f 58 34 4e 44 67 33 57 49 56 6b 73 44 79 51 6b 45 42 59 57 45 41 4d 6f 44 78 63 2b 4f 79 6e 38 32 43 6f 36 4f 69 6f 42 63 30 48 2b 7a 67 4c 31 4d 63 77 78 32 6a 49 69 4d 6a 4c 44 46 54 49 64 2f 75 59 79 71 44 45 6c 4d 44 49 43 65 69 77 73 2f 66 6e 2b 6c 70 59 43 42 79 78 38 2f 62 73 4d 44 69 78 57 49 4e 41 4d 44 69 4d 41 41 41 41 44 41 41 44 2f 77 41 51 41 41 38 41 41 45 77 41 79 41 49 4d 41 41 41 45 69 44 67 49 56 46 42 34 43 4d 7a 49 2b 41 6a 55 30 4c 67 49 44 44 67 45 6a 49 69 59 6e 4c 67 45 6e 4c 67 45 6e 4c Data Ascii: s8PCsCUis8QIH+MwGaz8uY3/6JAUQj/t/uM8cVb04MASqIVf6IPyoB4jEx/fQHFRwDdC5/Lf3pmgF0Ahct/X4NDg3WIVksDyQkEBYWEAMoDxc+Oyn82Co6OioBc0H+zgL1Mcwx2jIiMjLDFTId/uYyqDElMDICeiws/fn+lpYCByx8/bsMDixWINAMDiMAAAADAAD/wAQAA8AAEwAyAIMAAAEiDgIVFB4CMzI+AjU0LgIDDgEjIiYnLgEnLgEnL
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 49 4a 42 77 59 4f 42 77 63 4c 41 77 51 51 42 77 63 46 42 41 63 58 35 42 73 6f 4b 42 73 63 4a 79 63 63 4c 44 34 2b 4c 43 77 2b 50 73 73 50 46 52 55 50 44 68 55 56 44 69 41 73 4c 43 41 66 4c 43 77 66 41 53 7a 39 67 6a 45 39 50 54 45 42 46 67 49 42 41 51 4d 5a 44 77 59 4c 42 51 4d 48 41 77 49 47 43 51 49 4a 4a 52 63 42 41 77 49 42 41 51 4d 45 41 68 67 68 43 77 6b 47 41 51 59 44 42 77 4d 45 42 77 4d 4b 44 51 4e 53 4d 54 30 39 4d 61 46 61 50 31 59 47 51 43 6f 65 4d 77 38 48 44 51 63 59 4b 41 72 2b 2f 55 42 5a 41 51 45 42 48 52 6b 44 42 67 4d 52 45 77 46 49 4e 41 55 4c 42 67 6b 52 41 51 45 42 42 77 59 45 43 77 59 42 41 77 59 45 49 44 49 50 41 55 55 50 4d 69 45 44 42 77 4d 42 42 67 73 45 42 67 63 42 45 51 6f 47 44 51 59 76 50 77 45 55 45 67 49 46 41 78 6b 64 41 Data Ascii: IJBwYOBwcLAwQQBwcFBAcX5BsoKBscJyccLD4+LCw+PssPFRUPDhUVDiAsLCAfLCwfASz9gjE9PTEBFgIBAQMZDwYLBQMHAwIGCQIJJRcBAwIBAQMEAhghCwkGAQYDBwMEBwMKDQNSMT09MaFaP1YGQCoeMw8HDQcYKAr+/UBZAQEBHRkDBgMREwFINAULBgkRAQEBBwYECwYBAwYEIDIPAUUPMiEDBwMBBgsEBgcBEQoGDQYvPwEUEgIFAxkdA
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 73 46 4b 44 67 34 4b 41 55 4c 42 53 41 72 48 78 6b 31 45 78 4f 70 43 53 49 4f 2f 6b 34 63 53 46 52 64 4d 6a 78 77 58 30 30 61 42 51 67 46 47 43 77 55 46 77 38 68 45 51 67 51 43 41 38 52 45 51 38 49 45 41 67 36 57 41 73 44 44 67 73 44 42 48 42 51 42 51 67 46 47 6b 31 66 63 44 77 79 58 56 52 49 55 67 55 46 42 52 4d 4e 44 42 45 46 42 51 55 46 42 51 55 53 44 51 30 52 42 51 55 46 68 41 55 46 42 52 49 4f 44 42 45 46 42 51 55 46 42 51 55 54 44 51 77 52 42 51 55 46 41 41 49 42 41 50 2f 41 41 77 41 44 77 41 41 61 41 43 6f 41 41 41 45 6e 4c 67 45 78 49 67 59 50 41 51 59 55 48 77 45 57 4d 6a 38 42 45 54 4d 52 46 78 59 79 50 77 45 32 4a 68 45 55 42 69 4d 68 49 69 59 31 4d 54 51 32 4d 79 45 79 46 68 55 43 2f 50 49 43 43 67 49 47 41 76 41 45 42 42 59 45 44 67 53 77 51 Data Ascii: sFKDg4KAULBSArHxk1ExOpCSIO/k4cSFRdMjxwX00aBQgFGCwUFw8hEQgQCA8REQ8IEAg6WAsDDgsDBHBQBQgFGk1fcDwyXVRIUgUFBRMNDBEFBQUFBQUSDQ0RBQUFhAUFBRIODBEFBQUFBQUTDQwRBQUFAAIBAP/AAwADwAAaACoAAAEnLgExIgYPAQYUHwEWMj8BETMRFxYyPwE2JhEUBiMhIiY1MTQ2MyEyFhUC/PICCgIGAvAEBBYEDgSwQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49806	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	1543	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-01-15 23:16:17 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:17 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e87ba3a08b2900f3&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKvYUi6g1ubjuEI-YLp32FJUTV0qmvy1-U x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ks2CH7_5KcgCyhtKCp-cJLspDZ5nOJFILRHHiahUL6mu7KDB7JTTSA==
2024-01-15 23:16:17 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49808	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	370	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:17 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d35aced08287-IAD
2024-01-15 23:16:17 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49807	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	427	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	901	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:17 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d35ad9c40a87-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 8855 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:16:17 GMT Last-Modified: Fri, 17 Nov 2023 13:57:14 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: ob922d7d+ASp0GKFkXU4wA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1d20de8f-c01e-000f-736f-224fef000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:16:17 UTC	468	IN	Data Raw: 31 39 64 32 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 31 30 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 65 61 39 Data Ascii: 19d2{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea9
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 6c Data Ascii: ":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defaul
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 61 6c 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 70 72 22 2c 22 70 73 22 2c 22 70 77 22 2c 22 70 79 22 2c 22 71 61 22 2c 22 61 64 22 2c 22 61 65 22 2c 22 61 66 22 2c 22 61 67 22 2c 22 61 69 22 2c 22 61 6c 22 2c 22 61 6d 22 2c 22 61 6f 22 2c 22 61 71 22 2c 22 61 72 22 2c 22 61 73 22 2c 22 61 75 22 2c 22 61 77 22 2c 22 61 7a 22 2c 22 62 61 22 2c 22 62 62 22 2c 22 72 73 22 2c 22 62 64 22 2c 22 62 66 22 2c 22 72 77 22 2c 22 62 68 22 2c 22 62 69 22 2c 22 62 6a 22 2c 22 62 6c 22 2c 22 62 6d 22 2c 22 62 6e 22 2c 22 62 6f 22 2c 22 73 61 22 2c 22 73 62 22 2c 22 62 71 22 2c 22 73 63 22 2c 22 62 72 22 2c 22 62 73 22 2c 22 73 64 22 2c 22 62 74 22 2c 22 73 67 22 2c 22 62 76 22 2c 22 62 77 22 2c 22 73 68 22 2c 22 73 6a 22 2c 22 62 79 22 2c 22 62 7a 22 2c 22 73 6c Data Ascii: al","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","sb","bq","sc","br","bs","sd","bt","sg","bv","bw","sh","sj","by","bz","sl
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 22 3a 22 65 6c 22 2c 22 65 6e 22 3a 22 65 6e 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 73 2d 41 52 22 2c 22 6a 61 22 3a 22 6a 61 22 2c 22 74 6c 22 3a 22 74 6c 22 2c 22 70 6c 22 3a 22 70 6c 22 2c 22 72 6f 22 3a 22 72 6f 22 2c 22 68 65 22 3a 22 68 65 22 2c 22 64 61 22 3a 22 64 61 22 2c 22 74 72 22 3a 22 74 72 22 2c 22 6e 6c 22 3a 22 6e 6c 22 7d 2c 22 42 61 6e 6e 65 72 50 75 73 68 65 73 44 6f 77 6e 22 3a Data Ascii: ":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"es-AR","ja":"ja","tl":"tl","pl":"pl","ro":"ro","he":"he","da":"da","tr":"tr","nl":"nl"},"BannerPushesDown":
2024-01-15 23:16:17 UTC	1369	IN	Data Raw: 2c 22 47 6c 6f 62 61 6c 22 3a 66 61 6c 73 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 42 6c 75 65 20 64 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 54 Data Ascii: ,"Global":false,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Blue decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","createdT
2024-01-15 23:16:17 UTC	674	IN	Data Raw: 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 69 Data Ascii: s":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"CookieV2VendorServiceScri
2024-01-15 23:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49809	13.32.208.58	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	1329	OUT	POST /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 56 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/json;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-01-15 23:16:17 UTC	56	OUT	Data Raw: 7b 22 63 6c 69 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6c 69 65 6e 74 5f 69 64 22 3a 22 76 4f 31 4b 62 6c 6b 37 78 58 39 74 55 6e 32 63 70 5a 4c 53 22 7d Data Ascii: {"client_type":"web","client_id":"vO1Kblk7xX9tUn2cpZLS"}
2024-01-15 23:16:18 UTC	3314	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:17 GMT access-control-allow-credentials: true access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-allow-methods: POST access-control-allow-origin: https://www.booking.com access-control-max-age: 1728000 content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7liI11zToI6YQKAHtLgPX_crVHmLzhxl40; script-src 'report-sample' 'nonce-V94WsnlxNMKArwm' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7liI11zToI6YQKAHtLgPX_crVHmLzhxl40; script-src 'report-sample' 'nonce-V94WsnlxNMKArwm' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6IjE0ZDVmN2NjLTllNmMtNDgzNi04YzkzLWIxNDVjMTgyZGE0MSJ9fQ; domain=account.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:17 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 69e952c7b08727f752b5559b0b6d2108.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: jBD6DtIDg0fUifDcUNLc3zofTpaDR0QM_gf_LzbUQMTYmmOYBV2xVg==
2024-01-15 23:16:18 UTC	59	IN	Data Raw: 33 35 0d 0a 7b 22 63 6f 6e 73 65 6e 74 5f 69 64 22 3a 22 31 34 64 35 66 37 63 63 2d 39 65 36 63 2d 34 38 33 36 2d 38 63 39 33 2d 62 31 34 35 63 31 38 32 64 61 34 31 22 7d 0d 0a Data Ascii: 35{"consent_id":"14d5f7cc-9e6c-4836-8c93-b145c182da41"}
2024-01-15 23:16:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49810	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.9e2adf90.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 18701 Connection: close Last-Modified: Tue, 09 Jan 2024 06:10:23 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: jWtWiieM6ckedXFMaDQ5RuQshQ_5riIK Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 14:29:37 GMT ETag: "afa1621cfcede0d031f983b416d2eaa5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Z8GuUL_oGKwfujcVe6VEvXRSIIbX9Y6EOVJgkU147eW0K5r-jy9ICw== Age: 33257 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	15698	IN	Data Raw: 76 61 72 20 62 47 65 6e 69 75 73 56 69 70 57 65 62 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 63 65 37 36 30 33 65 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 47 65 6e 69 75 73 56 69 70 4d 6c 70 4f 6e 62 6f 61 72 64 69 6e 67 53 68 65 65 74 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 64 37 64 31 32 37 38 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 37 63 65 34 34 37 34 37 22 29 7d 7d 29 29 7d 2c 22 2e 2f 53 61 6d 70 6c 65 43 6f 6d 70 6f 6e 65 6e 74 22 3a 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: var bGeniusVipWebComponentService;!function(){"use strict";var e={ce7603eb:function(e,n,t){var r={"./GeniusVipMlpOnboardingSheet":function(){return t.e("8d7d1278").then((function(){return function(){return t("7ce44747")}}))},"./SampleComponent":function()
2024-01-15 23:16:17 UTC	3003	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 20 74 28 22 33 61 38 38 62 33 38 30 22 29 7d 7d 29 29 7d 29 29 7d 7d 2c 62 3d 7b 22 38 64 37 64 31 32 37 38 22 3a 5b 22 65 61 64 37 31 65 62 30 22 2c 22 64 63 36 64 32 38 66 66 22 2c 22 32 38 64 62 64 31 33 32 22 2c 22 64 31 65 35 34 61 39 36 22 2c 22 31 32 39 63 34 38 62 33 22 2c 22 63 65 64 63 61 62 66 39 22 2c 22 64 65 65 32 35 33 34 64 22 2c 22 63 34 34 64 63 62 30 63 22 2c 22 34 31 63 36 63 36 36 65 22 2c 22 32 33 39 62 65 62 31 37 22 5d 2c 66 31 65 64 37 38 65 32 3a 5b 22 65 61 64 37 31 65 62 30 22 2c 22 64 65 65 32 35 33 34 64 22 5d 2c 61 63 38 38 65 35 35 65 3a 5b 22 65 32 37 32 65 34 37 64 22 2c 22 65 61 64 37 31 65 62 30 22 5d 2c 65 35 32 37 38 34 35 31 3a 5b 22 65 61 64 37 31 65 62 30 22 5d 2c 64 30 35 34 65 34 64 62 Data Ascii: (){return t("3a88b380")}}))}))}},b={"8d7d1278":["ead71eb0","dc6d28ff","28dbd132","d1e54a96","129c48b3","cedcabf9","dee2534d","c44dcb0c","41c6c66e","239beb17"],f1ed78e2:["ead71eb0","dee2534d"],ac88e55e:["e272e47d","ead71eb0"],e5278451:["ead71eb0"],d054e4db

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49812	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	581	OUT	GET /psb/capla/static/js/client.923775ce.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	688	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1041024 Connection: close Date: Mon, 15 Jan 2024 08:46:38 GMT Last-Modified: Mon, 15 Jan 2024 08:33:15 GMT ETag: "a4618794d329c0c74897c7e2128aa1cc" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: MWQ8NYyocnzMbPoiKsqG.wjNMqQ87ZuL Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: EMM5gyN2nXBQB62rIbkZ77_kDcmPV9s0yEiMybt7ZEJ1T33DbLYrWw== Age: 52180 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	15696	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 39 32 33 37 37 35 63 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.923775ce.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 2e 31 38 39 2d 32 2e 33 37 38 20 31 31 2e 33 37 33 2d 35 2e 38 38 33 2e 38 33 2d 2e 39 32 2e 38 33 2d 32 2e 33 31 34 2e 30 30 32 2d 33 2e 32 33 32 61 32 31 2e 33 33 33 20 32 31 2e 33 33 33 20 30 20 30 20 30 2d 33 2e 31 38 39 2d 32 2e 38 36 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 38 38 34 20 31 2e 32 31 20 31 39 2e 38 31 36 20 31 39 2e 38 31 36 20 30 20 30 20 31 20 32 2e 39 36 32 20 32 2e 36 35 37 63 2e 33 31 2e 33 34 34 2e 33 31 2e 38 37 32 2d 2e 30 30 33 20 31 2e 32 31 39 2d 32 2e 39 32 20 33 2e 32 31 32 2d 36 2e 38 34 38 20 35 2e 34 34 36 2d 31 30 2e 32 35 34 20 35 2e 33 39 61 39 2e 32 37 32 20 39 2e 32 37 32 20 30 20 30 20 31 2d 32 2e 38 32 37 2d 2e 34 31 36 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 34 34 34 20 31 2e 34 33 32 7a 6d 35 2e 38 35 32 2d Data Ascii: .189-2.378 11.373-5.883.83-.92.83-2.314.002-3.232a21.333 21.333 0 0 0-3.189-2.86.75.75 0 0 0-.884 1.21 19.816 19.816 0 0 1 2.962 2.657c.31.344.31.872-.003 1.219-2.92 3.212-6.848 5.446-10.254 5.39a9.272 9.272 0 0 1-2.827-.416.75.75 0 0 0-.444 1.432zm5.852-
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 61 3d 6f 28 6e 28 22 36 63 63 31 65 31 30 38 22 29 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 76 61 72 20 6f 3d 28 30 2c 61 2e 64 65 66 61 75 6c 74 29 28 74 2c 6e 29 3b 72 65 74 75 72 6e 20 6f 3f 65 5b 6f 5d 3a 6e 75 6c 6c 7d 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 29 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 76 61 72 20 75 3d 28 30 2c 61 2e 64 65 66 61 75 6c 74 29 28 74 2c 6e 5b 69 5d 2c 7b 76 69 65 77 70 6f 72 74 3a 69 7d 29 3b 72 65 74 75 72 6e 20 75 3f 72 28 72 28 5b 5d 2c 6f Data Ascii: Property(t,"__esModule",{value:!0});var a=o(n("6cc1e108"));t.default=function(e,t,n){if("object"!==typeof n){var o=(0,a.default)(t,n);return o?e[o]:null}return Object.keys(n).reduce((function(o,i){var u=(0,a.default)(t,n[i],{viewport:i});return u?r(r([],o
2024-01-15 23:16:18 UTC	15496	IN	Data Raw: 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6f 66 66 73 65 74 57 69 64 74 68 3c 6f 2e 64 65 66 61 75 6c 74 2e 4d 45 44 49 55 4d 7d 7d 2c 22 35 32 37 32 62 63 36 30 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 3b 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 65 29 Data Ascii: urn document.documentElement&&document.documentElement.offsetWidth<o.default.MEDIUM}},"5272bc60":function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});t.default=function(e){var t=window.requestAnimationFrame;t((function(){return t(e)
2024-01-15 23:16:18 UTC	376	IN	Data Raw: 7a 65 2d 6d 65 64 69 75 6d 22 3a 22 63 32 63 63 30 35 30 66 62 38 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 22 3a 22 64 32 34 66 63 32 36 65 37 33 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 72 22 3a 22 64 62 65 64 36 32 33 62 36 39 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 73 74 22 3a 22 64 62 61 35 36 66 37 30 63 36 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 65 73 74 2d 2d 6d 22 3a 22 62 31 33 38 63 61 64 31 66 37 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 65 72 2d 2d 6d 22 3a 22 63 64 65 32 33 35 34 65 66 64 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 2d 2d 6d 22 3a 22 65 64 30 66 64 62 36 62 36 33 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 2d 2d 6d 22 Data Ascii: ze-medium":"c2cc050fb8","root--size-large":"d24fc26e73","root--size-larger":"dbed623b69","root--size-largest":"dba56f70c6","root--size-smallest--m":"b138cad1f7","root--size-smaller--m":"cde2354efd","root--size-small--m":"ed0fdb6b63","root--size-medium--m"
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 65 73 74 2d 2d 6c 22 3a 22 66 66 30 31 64 36 31 35 37 31 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 65 72 2d 2d 6c 22 3a 22 65 30 61 39 31 65 66 37 64 36 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 2d 2d 6c 22 3a 22 64 64 36 36 34 63 34 39 65 62 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 2d 2d 6c 22 3a 22 64 30 32 34 62 64 61 61 61 66 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 2d 2d 6c 22 3a 22 64 39 61 65 61 38 62 66 39 39 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 72 2d 2d 6c 22 3a 22 62 63 61 64 61 66 33 38 31 63 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 73 74 2d 2d 6c 22 3a 22 62 32 30 61 61 66 64 35 36 34 22 2c Data Ascii: ,"root--size-smallest--l":"ff01d61571","root--size-smaller--l":"e0a91ef7d6","root--size-small--l":"dd664c49eb","root--size-medium--l":"d024bdaaaf","root--size-large--l":"d9aea8bf99","root--size-larger--l":"bcadaf381c","root--size-largest--l":"b20aafd564",
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 74 65 6d 73 2c 64 3d 65 2e 6a 75 73 74 69 66 79 43 6f 6e 74 65 6e 74 2c 70 3d 65 2e 77 72 61 70 2c 68 3d 61 7c 7c 22 64 69 76 22 2c 6d 3d 6f 28 29 2e 43 68 69 6c 64 72 65 6e 2e 74 6f 41 72 72 61 79 28 72 29 2e 73 6f 6d 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 70 72 6f 70 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 67 72 6f 77 7d 29 29 2c 76 3d 28 30 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 73 29 28 55 2e 72 6f 6f 74 2c 28 30 2c 69 2e 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 4e 61 6d 65 73 29 28 55 2c 22 72 6f 6f 74 2d 2d 67 61 70 22 2c 6c 29 2c 28 30 2c 69 2e 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 4e 61 6d 65 73 29 28 55 2c 22 72 6f 6f 74 2d 2d Data Ascii: tems,d=e.justifyContent,p=e.wrap,h=a\|\|"div",m=o().Children.toArray(r).some((function(e){var t;return null===(t=e.props)\|\|void 0===t?void 0:t.grow})),v=(0,i.classNames)(U.root,(0,i.responsiveClassNames)(U,"root--gap",l),(0,i.responsiveClassNames)(U,"root--
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 63 5b 65 5d 7d 29 29 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6f 28 29 2e 46 72 61 67 6d 65 6e 74 2c 6e 75 6c 6c 2c 65 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 4d 65 2c 7b 61 62 6f 76 65 3a 6e 2b 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 3f 76 6f 69 64 20 30 3a 56 65 5b 74 5d 2c 62 65 6c 6f 77 3a 56 65 5b 74 5d 2c 6b 65 79 3a 74 7d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 63 6c 61 73 73 4e 61 6d 65 3b 72 65 74 75 72 6e 20 6c 28 6a 65 5b 63 5b 74 5d 5d 2c 6e 29 7d 29 29 7d 29 29 29 7d 28 29 2c 6e 26 26 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6e 65 2c Data Ascii: tion(e){return c[e]}));return o().createElement(o().Fragment,null,e.map((function(t,n){return o().createElement(Me,{above:n+1===e.length?void 0:Ve[t],below:Ve[t],key:t},(function(e){var n=e.className;return l(je[c[t]],n)}))})))}(),n&&o().createElement(ne,
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 64 2c 67 3d 66 2e 69 73 53 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 2c 62 3d 66 2e 69 73 53 65 6c 65 63 74 69 6f 6e 45 6e 64 2c 79 3d 66 2e 69 73 44 69 73 61 62 6c 65 64 2c 45 3d 66 2e 63 6c 61 73 73 4e 61 6d 65 2c 5f 3d 66 2e 61 63 63 65 73 73 69 62 69 6c 69 74 79 48 69 6e 74 2c 77 3d 66 2e 64 61 74 65 49 53 4f 2c 53 3d 74 2e 67 65 74 44 61 74 65 28 29 2c 6b 3d 28 30 2c 43 74 2e 67 65 74 4d 6f 6e 74 68 4e 61 6d 65 29 28 6c 2c 74 29 2c 4f 3d 22 22 2e 63 6f 6e 63 61 74 28 53 2c 22 20 22 29 2e 63 6f 6e 63 61 74 28 6b 2c 22 20 22 29 2e 63 6f 6e 63 61 74 28 74 2e 67 65 74 46 75 6c 6c 59 65 61 72 28 29 29 2c 54 3d 73 26 26 73 28 7b 64 61 74 65 3a 74 7d 29 2c 4e 3d 28 30 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 73 29 28 52 74 2e 64 61 74 65 2c 6d 26 26 52 74 5b 22 64 Data Ascii: d,g=f.isSelectionStart,b=f.isSelectionEnd,y=f.isDisabled,E=f.className,_=f.accessibilityHint,w=f.dateISO,S=t.getDate(),k=(0,Ct.getMonthName)(l,t),O="".concat(S," ").concat(k," ").concat(t.getFullYear()),T=s&&s({date:t}),N=(0,i.classNames)(Rt.date,m&&Rt["d
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 61 6c 75 65 2c 76 3d 72 2e 73 74 61 72 74 47 68 6f 73 74 73 43 6f 75 6e 74 2c 67 3d 72 2e 65 6e 64 47 68 6f 73 74 73 43 6f 75 6e 74 2c 62 3d 6f 28 29 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 2c 79 3d 6f 28 29 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 2c 45 3d 6f 28 29 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 2c 5f 3d 6f 28 29 2e 75 73 65 52 65 66 28 5b 5d 29 2c 77 3d 6f 28 29 2e 75 73 65 52 65 66 28 5b 5d 29 2c 53 3d 6f 28 29 2e 75 73 65 53 74 61 74 65 28 30 29 2c 6b 3d 53 5b 30 5d 2c 4f 3d 53 5b 31 5d 2c 54 3d 28 30 2c 63 2e 64 65 66 61 75 6c 74 29 28 29 2c 4e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 62 2e 63 75 72 72 65 6e 74 3b 69 66 28 65 29 72 65 74 75 72 6e 20 49 6e 28 65 2c 5f 2e 63 75 72 72 65 6e 74 29 7d 2c 78 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: alue,v=r.startGhostsCount,g=r.endGhostsCount,b=o().useRef(null),y=o().useRef(null),E=o().useRef(null),_=o().useRef([]),w=o().useRef([]),S=o().useState(0),k=S[0],O=S[1],T=(0,c.default)(),N=function(){var e=b.current;if(e)return In(e,_.current)},x=function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49811	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	589	OUT	GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	684	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 375 Connection: close Last-Modified: Fri, 05 Jan 2024 09:07:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: hCfLPXlWA4V5J8aga5fh4Wgj08QrnkeO Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 13:10:04 GMT ETag: "71d148d7e362a60e9a0c56222e4c1c42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 0f954bea3b233fb0b6e1981b1e8b6bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: HJ_SBFAmJDSzYlMQp8DNdkXOM4HCBYpn4SF1um5VHA7DAOFFvp_MMQ== Age: 36374 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	375	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 61 38 39 64 32 64 62 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 5f 2c 62 29 7b 62 2e 72 28 5f 29 3b 76 61 72 20 64 3d 62 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 64 2e 73 65 72 76 65 29 28 28 28 29 3d 3e 62 2e 65 28 22 30 61 30 39 38 32 38 34 22 29 2e 74 68 65 6e 28 62 2e 62 69 6e 64 28 62 2c 22 36 34 62 37 37 38 61 64 22 29 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4a89d2db"],{fe905f7b:function(e,_,b){b.r(_);var d=b("540adcd8");(0,d.serve)((()=>b.e("0a098284").then(b.bind(b,"64b778ad")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49815	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	422	OUT	GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1628 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-65c" X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: mtbXPUnBjok3CqRxM9hoxAKmqoDRyII7szuV3liK_potnXj7I-vmDw== Age: 1485896
2024-01-15 23:16:17 UTC	1628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 06 00 00 00 d8 32 20 50 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 05 b0 49 44 41 54 68 de ed d9 7d 6c 5f 65 15 07 f0 4f 3b 9c 1a e7 84 a1 88 a6 2a c2 4c e6 f6 53 27 be 47 2f 6e a2 cb 32 32 9d 62 64 be b4 73 fb 8d 28 64 b2 78 8d 98 b8 28 4a 88 e0 1f de d4 21 11 c6 aa bc cf 45 02 9b 0e 25 2c c2 e0 32 03 03 75 63 65 44 7c 19 93 1f 63 c8 d8 98 a8 98 ce 75 fe f1 9c 5f 7b 5b 5b 5c 4c 6d 33 ec 37 b9 f9 9d e7 9c e7 3e 2f df e7 3c e7 9c db b6 1c 3e 7c d8 38 46 07 ad 63 bd 80 ff 27 8c 93 3d 8a 18 Data Ascii: PNGIHDR[2 PgAMAa cHRMz&u0`:pQ<bKGDCIDATh}l_eO;*LS'G/n22bds(dx(J!E%,2uceD\|cu_{[[\Lm37>/<>\|8Fc'=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49813	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	424	OUT	GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-637" X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: jh2GCZ9ack4r-sPwLnjpvnTEs6Kg0LaVE29p8YkqRgpqSGwORS6YUw== Age: 1485896
2024-01-15 23:16:17 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 03 00 00 00 ef ec d0 62 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 02 2e 50 4c 54 45 ff ff ff 00 00 00 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 Data Ascii: PNGIHDR[bgAMAa cHRMz&u0`:pQ<.PLTE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49814	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	420	OUT	GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1154 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:09 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Sun, 28 Jan 2024 18:31:09 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-482" X-Cache: Hit from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: hgR0PDfPgZ0n-Ce0d5uMkIe5-zdotz3PXAbjNUWrOxAk_TmGXJEARw== Age: 1485908
2024-01-15 23:16:17 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 1a 08 06 00 00 00 f6 77 01 c2 00 00 04 49 49 44 41 54 78 01 ed 98 03 b0 ed 3a 18 85 73 6c 9f 67 db b6 79 6d df 7b 6c 6c 3d db b6 6d db b6 6d db b6 cd ef b5 b3 66 5e f6 41 b3 31 7a 68 67 fe 69 3a c9 ca ca 5a 4d fe a4 35 40 18 59 46 9a 0d c3 08 cd 0b cd 0b cd 0b cd 0b cd eb af fa c0 8b 6f b3 88 03 bc 68 55 39 ab 98 e0 c5 dd ff 42 ee 73 bd 68 f2 e2 1c df 3c b2 8c 93 bc 88 91 3d 7e 96 17 af fe 0b b9 ef f2 62 8a 17 27 18 b9 a9 0a e2 35 d0 6c 60 aa 81 56 a3 e7 e9 7a a6 a7 14 62 35 c9 9d 1c ee 45 d7 a0 8e 85 e9 c8 17 c6 8f ee 92 c1 38 85 06 f0 a8 17 10 a9 f6 a2 06 66 0a 43 5b 0e 6c 53 03 8d 7a a6 49 63 49 8b bb cd 58 ee de 72 88 3a b9 87 ea ee 2e d6 78 a7 59 dd 83 fa b8 11 f0 7d 2b 1b 68 5e 47 Data Ascii: PNGIHDROwIIDATx:slgym{ll=mmf^A1zhgi:ZM5@YFohU9Bsh<=~b'5l`Vzb5E8fC[lSzIcIXr:.xY}+h^G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49816	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	420	OUT	GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2146 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Thu, 12 Mar 2020 10:15:57 GMT Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5e6a0bdd-862" X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: s25q71TYTFVyMbDcdaetF-1uMYkd4XYVVlT8HqHPHNI_kXrdnvBH6g== Age: 1485896
2024-01-15 23:16:17 UTC	2146	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 46 00 00 00 1a 08 06 00 00 00 0a 62 2a 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 f7 49 44 41 54 78 01 ed 59 0d 70 54 d5 15 3e f7 be f7 96 b0 09 91 90 84 1a 13 65 19 a5 ad 96 66 00 2b 28 54 c9 4c 06 04 4b 69 5a 0b f9 d9 8d 04 d3 80 60 d5 da b1 63 3b 76 20 99 b6 d8 b1 d3 b1 83 75 c4 88 4d 82 bb 9b 68 a6 94 aa 80 18 a7 a4 02 05 44 4a eb 0f 52 51 a0 0a 2d 3f 21 46 6c 42 d8 7d ef de 7e 77 cd 8b 2f 9b b7 ce db 19 98 11 c7 33 73 f7 fe 7d ef dc 73 bf 7b ee b9 f7 bd 65 74 91 4b 79 79 f9 95 ba ae af 3b 76 ec d8 cc ce ce 4e 93 ce 93 70 ba c8 85 1b c6 04 49 34 3d 10 08 e8 74 1e e5 a2 27 e6 42 Data Ascii: PNGIHDRFb*pHYssRGBgAMAaIDATxYpT>ef+(TLKiZ`c;v uMhDJRQ-?!FlB}~w/3s}s{etKyy;vNpI4=t'B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49805	172.253.115.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	814	OUT	GET /gsi/client HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:18 UTC	1138	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Expires: Mon, 15 Jan 2024 23:16:17 GMT Date: Mon, 15 Jan 2024 23:16:17 GMT Cache-Control: private, max-age=1800 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Content-Security-Policy: script-src 'report-sample' 'nonce-ZXSv5h3lApci2m6dQP78KQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:18 UTC	114	IN	Data Raw: 38 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 67 73 69 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 67 73 69 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a Data Ascii: 8000"use strict";this.default_gsi=this.default_gsi\|\|{};(function(_){var window=this;try{_._F_toggles_initializ
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 33 61 31 34 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 63 61 2c 64 61 2c 74 2c 65 61 2c 66 61 2c 68 61 2c 6a 61 3b 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 Data Ascii: e=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a1400, ]);var aa,ba,ca,da,t,ea,fa,ha,ja;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,v
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 64 61 5b 62 5b 63 5d 5d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 Data Ascii: rator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=da[b[c]];"function"===typeof d&&"function"
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 65 60 22 2b 61 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 5f 2e 6e 61 3d 6a 61 3b 74 28 22 52 65 66 6c 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 5f 2e 6e 61 3f 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 74 72 79 7b 72 65 74 75 72 6e 28 30 2c 5f 2e 6e 61 29 28 62 2c 63 29 2c 21 30 7d 63 61 74 63 68 28 64 29 7b 72 65 74 75 72 6e 21 31 7d 7d 3a 6e 75 6c 6c 7d 29 3b 0a 74 28 22 50 72 6f 6d 69 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 74 68 69 73 2e 67 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 63 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 67 Data Ascii: new TypeError("e`"+a);return a}:null}_.na=ja;t("Reflect.setPrototypeOf",function(a){return a?a:_.na?function(b,c){try{return(0,_.na)(b,c),!0}catch(d){return!1}}:null});t("Promise",function(a){function b(){this.g=null}function c(g){return g instanceof e?g
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 3f 74 68 69 73 2e 4d 28 68 2c 67 29 3a 74 68 69 73 2e 6d 28 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 75 28 32 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 75 28 31 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 69 66 28 30 21 3d 74 68 69 73 2e 67 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 60 22 2b 67 2b 22 60 22 2b 68 2b 22 60 22 2b 74 68 69 73 2e 67 29 3b 74 68 69 73 2e 67 3d 67 3b 74 68 69 73 2e 69 3d 68 3b 32 3d 3d 3d 74 68 69 73 2e 67 26 26 74 68 69 73 2e 48 28 29 3b 74 68 69 73 2e 42 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: nction"==typeof h?this.M(h,g):this.m(g)};e.prototype.l=function(g){this.u(2,g)};e.prototype.m=function(g){this.u(1,g)};e.prototype.u=function(g,h){if(0!=this.g)throw Error("g`"+g+"`"+h+"`"+this.g);this.g=g;this.i=h;2===this.g&&this.H();this.B()};e.prototy
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6d 2e 67 29 7b 63 61 73 65 20 31 3a 67 28 6d 2e 69 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6d 2e 69 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 68 60 22 2b 6d 2e 67 29 3b 7d 7d 76 61 72 20 6d 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 68 3f 66 2e 68 28 6b 29 3a 0a 74 68 69 73 2e 68 2e 70 75 73 68 28 6b 29 3b 74 68 69 73 2e 6f 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 Data Ascii: tch=function(g){return this.then(void 0,g)};e.prototype.jb=function(g,h){function k(){switch(m.g){case 1:g(m.i);break;case 2:h(m.i);break;default:throw Error("h`"+m.g);}}var m=this;null==this.h?f.h(k):this.h.push(k);this.o=!0};e.resolve=c;e.reject=functi
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 64 20 30 7d 72 65 74 75 72 6e 20 62 7d 7d 29 3b 0a 74 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 63 28 6b 29 7b 76 61 72 20 6d 3d 74 79 70 65 6f 66 20 6b 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 6d 26 26 6e 75 6c 6c 21 3d 3d 6b 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 6d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 6b 29 7b 69 66 28 21 66 61 28 6b 2c 66 29 29 7b 76 61 72 20 6d 3d 6e 65 77 20 62 3b 62 61 28 6b 2c 66 2c 7b 76 61 6c 75 65 3a 6d 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 76 61 72 20 6d 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6d 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 Data Ascii: d 0}return b}});t("WeakMap",function(a){function b(){}function c(k){var m=typeof k;return"object"===m&&null!==k\|\|"function"===m}function d(k){if(!fa(k,f)){var m=new b;ba(k,f,{value:m})}}function e(k){var m=Object[k];m&&(Object[k]=function(n){if(n instanc
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6b 3d 6e 65 77 20 61 28 5f 2e 75 28 5b 5b 68 2c 22 73 22 5d 5d 29 29 3b 69 66 28 22 73 22 21 3d 6b 2e 67 65 74 28 68 29 7c 7c 31 21 3d 6b 2e 73 69 7a 65 7c 7c 6b 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6b 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6b 7c 7c 32 21 3d 6b 2e 73 69 7a 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6d 3d 6b 2e 65 6e 74 72 69 65 73 28 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 69 66 28 6e 2e 64 6f 6e 65 7c 7c 6e 2e 76 61 6c 75 65 5b 30 5d 21 3d 68 7c 7c 22 73 22 21 3d 6e 2e 76 61 6c 75 65 5b 31 5d 29 72 65 74 75 72 6e 21 31 3b 6e 3d 6d 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6e 2e 64 6f 6e 65 7c 7c 34 21 3d 6e 2e 76 61 6c 75 65 5b Data Ascii: 1;try{var h=Object.seal({x:4}),k=new a(_.u([[h,"s"]]));if("s"!=k.get(h)\|\|1!=k.size\|\|k.get({x:4})\|\|k.set({x:4},"t")!=k\|\|2!=k.size)return!1;var m=k.entries(),n=m.next();if(n.done\|\|n.value[0]!=h\|\|"s"!=n.value[1])return!1;n=m.next();return n.done\|\|4!=n.value[
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 65 79 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6d 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 0a 6e 3b 21 28 6e 3d 6d 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6e 3d 6e 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6e 5b 31 5d 2c 6e 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 Data Ascii: ey})};c.prototype.values=function(){return e(this,function(h){return h.value})};c.prototype.forEach=function(h,k){for(var m=this.entries(),n;!(n=m.next()).done;)n=n.value,h.call(k,n[1],n[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=fu
2024-01-15 23:16:18 UTC	1252	IN	Data Raw: 7b 76 61 6c 75 65 3a 62 28 66 2c 61 5b 66 5d 29 2c 64 6f 6e 65 3a 21 31 7d 7d 64 3d 21 30 3b 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 7d 3b 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 65 7d 3b 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 7d 29 7d 7d 29 3b 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 Data Ascii: {value:b(f,a[f]),done:!1}}d=!0;return{done:!0,value:void 0}}};e[Symbol.iterator]=function(){return e};return e};t("Array.prototype.values",function(a){return a?a:function(){return pa(this,function(b,c){return c})}});t("Array.prototype.keys",function(a){re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49817	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	589	OUT	GET /psb/capla/static/js/0a098284.3c62999d.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 40091 Connection: close Last-Modified: Fri, 12 Jan 2024 16:20:06 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: nY6TEl6_nIlXy8qUAyaguBIxATaLZkyB Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 18:04:59 GMT ETag: "77d9652109edcbe3f31b58b71033f4fa" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ddMaXGq89jtnvvsu137OkajmB_JqboDqXf_NqhWOUbOeGTn5Dedzlw== Age: 18679 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 30 61 30 39 38 32 38 34 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 6e 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 72 3d 74 28 22 36 65 65 38 38 63 35 34 22 29 2c 73 3d 74 28 22 64 63 36 64 32 38 66 66 22 29 2c 6f 3d 74 28 22 64 31 65 35 34 61 39 36 22 29 Data Ascii: (self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0a098284"],{"181eacc8":function(e,n,t){"use strict";t.d(n,{d:function(){return i}});var r=t("6ee88c54"),s=t("dc6d28ff"),o=t("d1e54a96")
2024-01-15 23:16:17 UTC	16384	IN	Data Raw: 21 21 74 2e 6d 5b 6e 5d 7d 2c 69 6d 70 6f 72 74 41 73 79 6e 63 3a 28 29 3d 3e 74 2e 65 28 22 63 66 62 64 64 32 33 35 22 29 2e 74 68 65 6e 28 74 2e 62 69 6e 64 28 74 2c 22 35 33 33 35 34 36 39 33 22 29 29 2c 72 65 71 75 69 72 65 41 73 79 6e 63 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 72 65 73 6f 6c 76 65 28 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 73 6f 6c 76 65 64 5b 6e 5d 3d 21 31 2c 74 68 69 73 2e 69 6d 70 6f 72 74 41 73 79 6e 63 28 65 29 2e 74 68 65 6e 28 28 65 3d 3e 28 74 68 69 73 2e 72 65 73 6f 6c 76 65 64 5b 6e 5d 3d 21 30 2c 65 29 29 29 7d 2c 72 65 71 75 69 72 65 53 79 6e 63 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 72 65 73 6f 6c 76 65 28 65 29 3b 72 65 74 75 72 6e 20 74 28 6e 29 7d 2c 72 65 73 6f 6c 76 65 28 29 7b 72 Data Ascii: !!t.m[n]},importAsync:()=>t.e("cfbdd235").then(t.bind(t,"53354693")),requireAsync(e){const n=this.resolve(e);return this.resolved[n]=!1,this.importAsync(e).then((e=>(this.resolved[n]=!0,e)))},requireSync(e){const n=this.resolve(e);return t(n)},resolve(){r
2024-01-15 23:16:18 UTC	7323	IN	Data Raw: 6e 75 6c 6c 3b 76 61 72 20 6e 3d 5b 5d 3b 72 65 74 75 72 6e 7b 73 65 74 50 72 6f 6d 70 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 3d 6e 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 65 3d 3d 3d 6e 26 26 28 65 3d 6e 75 6c 6c 29 7d 7d 2c 63 6f 6e 66 69 72 6d 54 72 61 6e 73 69 74 69 6f 6e 54 6f 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 2c 73 29 7b 69 66 28 6e 75 6c 6c 21 3d 65 29 7b 76 61 72 20 6f 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 65 3f 65 28 6e 2c 74 29 3a 65 3b 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 6f 3f 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 72 3f 72 28 6f 2c 73 29 3a 73 28 21 30 29 3a 73 28 21 31 21 3d 3d 6f 29 7d 65 6c 73 65 20 73 28 21 30 29 7d 2c 61 70 70 65 6e 64 4c 69 Data Ascii: null;var n=[];return{setPrompt:function(n){return e=n,function(){e===n&&(e=null)}},confirmTransitionTo:function(n,t,r,s){if(null!=e){var o="function"===typeof e?e(n,t):e;"string"===typeof o?"function"===typeof r?r(o,s):s(!0):s(!1!==o)}else s(!0)},appendLi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49819	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	425	OUT	GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3221 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:03:07 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-c95" Expires: Sun, 28 Jan 2024 18:03:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 48b970169016f7185b7cff9e185ee0b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Z3Y1QvtM6NSTqAYCtMzbIlXRAKKbp7OqHSvAVur-pNrtXEwx4n7vxA== Age: 1487590
2024-01-15 23:16:17 UTC	3221	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 1a 08 06 00 00 00 bd df d2 2f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0c 4f 49 44 41 54 68 05 ed 58 09 70 55 d5 19 3e db bd f7 bd 97 97 10 96 08 28 2a 20 2e 54 dc 06 c8 c2 b8 a0 ad 56 a7 d8 ba 94 5a ac 15 6d ad 4e 6b 88 84 22 ee ed 43 45 a7 15 4d 7c 11 bb 28 2d 4b ad 1d 1d f7 3a ad 58 ad e8 08 01 8c 58 64 b1 18 50 89 28 45 08 42 c8 7b f7 de b3 f5 3b 2f 09 26 a2 33 a5 33 b5 33 ed 3b 90 f7 ce 3b e7 3f ff f9 ff ef 5f ef 25 a4 38 8a 08 14 11 28 22 50 44 a0 88 40 11 81 22 02 45 04 8a 08 fc ab 08 d0 cf 23 ac ba 37 1e 4b 19 3f 9f 51 32 d8 5a 1b 82 ee e5 3d 3b ff fe d4 ba cc b1 f1 e7 9d 29 ae 7f 31 08 7c 86 d1 2c 85 c1 6e e6 5c dc c4 93 2c a0 dd 14 1a a6 d2 52 3d 2f 55 3c b5 a5 be e4 c3 2f Data Ascii: PNGIHDRm/sRGBOIDAThXpU>(* .TVZmNk"CEM\|(-K:XXdP(EB{;/&333;;?_%8("PD@"E#7K?Q2Z=;)1\|,n\,R=/U</

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49820	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	424	OUT	GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:17 UTC	770	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2344 Connection: close Server: nginx Date: Fri, 29 Dec 2023 18:31:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-928" Expires: Sun, 28 Jan 2024 18:31:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 8sp1c_mZUUsSFOAOojlGLJeRebGC0m5lsEnSQzHp9ccntQdS1CPaEQ== Age: 1485896
2024-01-15 23:16:17 UTC	2344	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 1a 08 06 00 00 00 d1 d9 80 2a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 08 e2 49 44 41 54 68 05 ed 58 0d 6c 14 c7 15 9e 99 dd db bb 60 c7 7f 18 8a 00 e3 bb b3 8d 4b 0f 27 6d dd c4 e0 24 c4 b5 09 a8 54 69 d3 46 95 d3 54 a4 4a 4b aa 34 41 aa 22 51 5a 94 d2 d2 a4 6d 1a aa d2 8a a6 b4 a9 42 d3 94 a8 aa 84 92 42 d2 10 a5 d4 89 15 2c 88 9d 98 56 16 16 f1 0f 77 36 38 14 c2 bf 7f ce ec ed ee 4c bf 77 3e 1f dc fa 0c 3e 47 8a 50 72 23 cd ed cc 7b 6f de cc 7c ef cd 7b 33 c7 58 b6 64 11 c8 22 90 45 e0 43 45 80 7f d0 d9 c2 b5 f5 a5 4a b1 5a a5 44 48 31 39 5b 32 6e 41 69 bf 10 da 3b e6 85 58 5b a8 b3 79 f8 83 ce f1 51 1d 3f 6d f0 df ad 69 b8 c1 10 7c 9d 64 ec 4e 83 f3 02 ce 52 55 c5 14 38 8c 75 e1 Data Ascii: PNGIHDR_*sRGBIDAThXl`K'm$TiFTJK4A"QZmBB,Vw68Lw>>GPr#{o\|{3Xd"ECEJZDH19[2nAi;X[yQ?mi\|dNRU8u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49821	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	589	OUT	GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 14956 Connection: close Date: Mon, 15 Jan 2024 16:49:45 GMT Last-Modified: Mon, 15 Jan 2024 16:23:25 GMT ETag: "3dea702266bc3a577d7141f2e79259db" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XlrxmKGuatqP44w.p7biLYQQatvO241o Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: i-Opc38d830KFNbmq2GqZOA8cJqPiy6zF9C5SoTGPQ6dT_xEYUtP0A== Age: 23193 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	14956	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 62 63 62 30 31 35 65 22 5d 2c 7b 61 66 31 65 32 62 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 61 3d 74 28 22 36 65 65 38 38 63 35 34 22 29 2c 72 3d 74 28 22 64 63 36 64 32 38 66 66 22 29 3b 63 6f 6e 73 74 20 69 3d 28 29 3d 3e 7b 63 6f 6e 73 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7bcb015e"],{af1e2b38:function(e,n,t){t.d(n,{Z:function(){return i}});var a=t("6ee88c54"),r=t("dc6d28ff");const i=()=>{cons

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49823	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	1164	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605681 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577
2024-01-15 23:16:18 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:18 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:18 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=252ca3a1c3070098&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzh6cP9SUqttqZow494D0tDTk6ZqWinLTp x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: m9c6o7SVAG3aq6rr3Q1h5JIEjfuwFo7lSvTOQ2R8oQuRAfzsDAdBYQ==
2024-01-15 23:16:18 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49822	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	585	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	535	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 1093598 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:18 GMT cache-control: private, max-age=86400 last-modified: Mon, 15 Jan 2024 23:16:18 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc2-1f2e790f157191b03d854766 X-Cache: Miss from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NlGgNKdC-QqW03RfVcSvj-7lhpSWWvkPmq80ERl0eJq4Ak5lWifMpQ==
2024-01-15 23:16:18 UTC	15849	IN	Data Raw: 2f 2a 21 20 3c 21 2d 40 70 72 65 73 65 72 76 65 20 41 57 53 20 57 41 46 20 49 6e 74 65 67 72 61 74 69 6f 6e 20 44 65 76 65 6c 6f 70 65 72 20 47 75 69 64 65 20 3c 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 61 77 73 2e 61 6d 61 7a 6f 6e 2e 63 6f 6d 2f 77 61 66 2f 6c 61 74 65 73 74 2f 64 65 76 65 6c 6f 70 65 72 67 75 69 64 65 2f 77 61 66 2d 6a 61 76 61 73 63 72 69 70 74 2d 73 64 6b 2e 68 74 6d 6c 3e 2d 2d 3e 20 2a 2f 0a 76 61 72 20 61 32 5f 30 78 35 64 62 66 3d 5b 27 53 65 67 6f 65 5c 78 32 30 55 49 5c 78 32 30 4c 69 67 68 74 27 2c 27 43 61 6e 6e 6f 74 5c 78 32 30 72 65 61 64 5c 78 32 30 53 61 66 65 42 61 67 2e 27 2c 27 63 72 65 61 74 65 45 6e 76 65 6c 6f 70 65 64 44 61 74 61 27 2c 27 65 76 65 6e 74 73 27 2c 27 4e 65 74 77 6f 72 6b 5c 78 32 30 72 65 73 70 6f 6e Data Ascii: /! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /var a2_0x5dbf=['Segoe\x20UI\x20Light','Cannot\x20read\x20SafeBag.','createEnvelopedData','events','Network\x20respon
2024-01-15 23:16:18 UTC	15467	IN	Data Raw: 76 31 5f 35 27 2c 27 74 6f 6b 65 6e 27 2c 27 61 64 64 27 2c 27 73 74 61 74 65 27 2c 27 53 77 69 73 37 32 31 5c 78 32 30 42 6c 6b 5c 78 32 30 42 54 27 2c 27 75 6e 73 75 70 70 6f 72 74 65 64 27 2c 27 78 6f 72 27 2c 27 61 74 74 61 63 68 45 76 65 6e 74 27 2c 27 6d 75 6c 74 69 70 6c 79 55 70 70 65 72 54 6f 27 2c 27 41 72 69 61 6c 5c 78 32 30 47 72 65 65 6b 27 2c 27 43 65 72 74 69 66 69 63 61 74 69 6f 6e 52 65 71 75 65 73 74 49 6e 66 6f 2e 61 74 74 72 69 62 75 74 65 73 27 2c 27 77 69 64 74 68 27 2c 27 45 78 74 65 6e 73 69 6f 6e 5c 78 32 30 5c 78 32 32 69 70 5c 78 32 32 5c 78 32 30 76 61 6c 75 65 5c 78 32 30 69 73 5c 78 32 30 6e 6f 74 5c 78 32 30 61 5c 78 32 30 76 61 6c 69 64 5c 78 32 30 49 50 76 34 5c 78 32 30 6f 72 5c 78 32 30 49 50 76 36 5c 78 32 30 61 64 64 Data Ascii: v1_5','token','add','state','Swis721\x20Blk\x20BT','unsupported','xor','attachEvent','multiplyUpperTo','Arial\x20Greek','CertificationRequestInfo.attributes','width','Extension\x20\x22ip\x22\x20value\x20is\x20not\x20a\x20valid\x20IPv4\x20or\x20IPv6\x20add
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 6c 74 27 2c 27 64 65 63 72 79 70 74 50 72 69 76 61 74 65 4b 65 79 49 6e 66 6f 27 2c 27 5f 5f 65 78 74 65 6e 64 73 27 2c 27 50 4d 69 6e 67 4c 69 55 2d 45 78 74 42 27 2c 27 63 61 6c 63 75 6c 61 74 65 27 2c 27 65 6e 63 4f 69 64 27 2c 27 47 65 6e 65 72 61 74 6f 72 5c 78 32 30 69 73 5c 78 32 30 61 6c 72 65 61 64 79 5c 78 32 30 65 78 65 63 75 74 69 6e 67 2e 27 2c 27 49 6e 76 61 6c 69 64 5c 78 32 30 6b 65 79 5c 78 32 30 70 61 72 61 6d 65 74 65 72 73 2e 5c 78 32 30 4f 6e 6c 79 5c 78 32 30 52 53 41 5c 78 32 30 69 73 5c 78 32 30 73 75 70 70 6f 72 74 65 64 2e 27 2c 27 52 65 63 69 70 69 65 6e 74 49 6e 66 6f 27 2c 27 32 2e 35 2e 32 39 2e 33 34 27 2c 27 50 4d 69 6e 67 4c 69 55 27 2c 27 5f 69 6e 69 74 27 2c 27 52 53 41 53 53 41 2d 50 4b 43 53 31 2d 56 31 5f 35 27 2c 27 Data Ascii: lt','decryptPrivateKeyInfo','__extends','PMingLiU-ExtB','calculate','encOid','Generator\x20is\x20already\x20executing.','Invalid\x20key\x20parameters.\x20Only\x20RSA\x20is\x20supported.','RecipientInfo','2.5.29.34','PMingLiU','_init','RSASSA-PKCS1-V1_5','
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 68 65 5c 78 32 30 63 68 61 69 6e 5c 78 32 30 6f 72 5c 78 32 30 69 73 6e 5c 78 32 37 74 5c 78 32 30 74 68 65 5c 78 32 30 66 69 72 73 74 5c 78 32 30 74 68 65 6e 5c 78 32 30 74 68 65 5c 78 32 30 63 65 72 74 69 66 69 63 61 74 65 5c 78 32 30 6d 75 73 74 5c 78 32 30 62 65 5c 78 32 30 61 5c 78 32 30 76 61 6c 69 64 5c 78 32 30 43 41 2e 27 2c 27 66 72 65 71 75 65 6e 63 79 27 2c 27 72 65 6d 6f 76 65 43 65 72 74 69 66 69 63 61 74 65 27 2c 27 55 6e 6b 6e 6f 77 6e 5c 78 32 30 68 61 73 68 5c 78 32 30 61 6c 67 6f 72 69 74 68 6d 3a 5c 78 32 30 27 2c 27 61 6c 67 6f 72 69 74 68 6d 49 64 65 6e 74 69 66 69 65 72 27 2c 27 70 61 74 68 4c 65 6e 43 6f 6e 73 74 72 61 69 6e 74 27 2c 27 70 6c 75 67 69 6e 73 27 2c 27 5c 78 32 30 28 49 6e 74 65 67 65 72 29 27 2c 27 72 65 73 75 6c 74 Data Ascii: he\x20chain\x20or\x20isn\x27t\x20the\x20first\x20then\x20the\x20certificate\x20must\x20be\x20a\x20valid\x20CA.','frequency','removeCertificate','Unknown\x20hash\x20algorithm:\x20','algorithmIdentifier','pathLenConstraint','plugins','\x20(Integer)','result
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 75 72 6e 20 5f 30 78 33 39 37 31 32 38 3b 7d 29 2c 5f 30 78 32 34 64 66 31 31 5b 27 64 27 5d 28 5f 30 78 31 34 37 31 63 39 2c 5f 30 78 33 66 34 61 62 39 28 30 78 61 31 64 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 63 62 35 64 61 36 3b 7d 29 2c 5f 30 78 32 34 64 66 31 31 5b 27 64 27 5d 28 5f 30 78 31 34 37 31 63 39 2c 5f 30 78 33 66 34 61 62 39 28 30 78 32 61 34 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 34 62 36 32 39 62 3b 7d 29 2c 5f 30 78 32 34 64 66 31 31 5b 27 64 27 5d 28 5f 30 78 31 34 37 31 63 39 2c 5f 30 78 33 66 34 61 62 39 28 30 78 34 37 65 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 32 32 35 36 30 37 3b 7d 29 2c 5f 30 78 32 34 64 66 31 31 5b 27 64 27 5d 28 5f 30 78 31 Data Ascii: urn _0x397128;}),_0x24df11['d'](_0x1471c9,_0x3f4ab9(0xa1d),function(){return _0xcb5da6;}),_0x24df11['d'](_0x1471c9,_0x3f4ab9(0x2a4),function(){return _0x4b629b;}),_0x24df11['d'](_0x1471c9,_0x3f4ab9(0x47e),function(){return _0x225607;}),_0x24df11['d'](_0x1
2024-01-15 23:16:18 UTC	8726	IN	Data Raw: 78 35 62 31 35 36 36 5b 30 78 62 5d 5d 3a 28 5f 30 78 34 66 65 66 64 37 3d 74 68 69 73 2c 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 30 5d 2c 74 68 69 73 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 33 5d 5d 28 29 5d 29 3b 63 61 73 65 20 5f 30 78 35 62 31 35 36 36 5b 30 78 32 5d 3a 5f 30 78 34 66 65 66 64 37 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 38 5d 5d 3d 5f 30 78 35 66 31 37 66 32 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 61 5d 5d 28 29 2c 5f 30 78 35 66 31 37 66 32 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 34 5d 5d 3d 5f 30 78 35 62 31 35 36 36 5b 30 78 62 5d 3b 63 61 73 65 20 5f 30 78 35 62 31 35 36 36 5b 30 78 62 5d 3a 72 65 74 75 72 6e 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 62 5d 2c 74 68 69 73 5b 5f 30 78 35 62 31 35 36 36 5b 30 78 38 5d 5d 5d 3b 7d 7d 29 3b 7d Data Ascii: x5b1566[0xb]]:(_0x4fefd7=this,[_0x5b1566[0x0],this[_0x5b1566[0x3]]()]);case _0x5b1566[0x2]:_0x4fefd7[_0x5b1566[0x8]]=_0x5f17f2[_0x5b1566[0xa]](),_0x5f17f2[_0x5b1566[0x4]]=_0x5b1566[0xb];case _0x5b1566[0xb]:return[_0x5b1566[0xb],this[_0x5b1566[0x8]]];}});}
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 62 5b 5f 30 78 35 38 36 64 32 65 5d 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 38 5d 5d 28 29 3b 7d 66 6f 72 28 5f 30 78 34 63 65 39 35 35 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 31 32 5d 5d 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 30 5d 5d 3d 5f 30 78 32 30 36 65 62 62 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 62 5d 5d 28 5f 30 78 35 61 34 36 63 36 5b 30 78 31 37 5d 29 2b 5f 30 78 35 61 34 36 63 36 5b 30 78 36 5d 2c 77 69 6e 64 6f 77 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 31 31 5d 5d 28 5f 30 78 35 61 34 36 63 36 5b 30 78 31 62 5d 2c 5f 30 78 35 61 34 36 63 36 5b 30 78 31 62 5d 29 2c 5f 30 78 34 63 65 39 35 35 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 31 63 5d 5d 5b 5f 30 78 35 61 34 36 63 36 5b 30 78 31 30 5d 5d 28 5f 30 78 34 63 65 39 35 35 29 3b 5f 30 78 34 31 32 Data Ascii: b[_0x586d2e][_0x5a46c6[0x8]]();}for(_0x4ce955[_0x5a46c6[0x12]][_0x5a46c6[0x0]]=_0x206ebb[_0x5a46c6[0xb]](_0x5a46c6[0x17])+_0x5a46c6[0x6],window[_0x5a46c6[0x11]](_0x5a46c6[0x1b],_0x5a46c6[0x1b]),_0x4ce955[_0x5a46c6[0x1c]][_0x5a46c6[0x10]](_0x4ce955);_0x412
2024-01-15 23:16:18 UTC	1514	IN	Data Raw: 61 39 29 2c 2f 5b 5e 30 2d 39 5d 2f 67 2c 30 2e 33 38 37 32 34 32 37 35 34 36 36 39 36 37 38 34 2c 5f 30 78 34 31 39 61 32 34 28 30 78 39 39 31 29 2c 27 2e 27 2c 30 78 31 2c 5f 30 78 34 31 39 61 32 34 28 30 78 61 66 39 29 2c 30 78 30 2c 5f 30 78 34 31 39 61 32 34 28 30 78 62 62 31 29 2c 2f 28 5b 30 2d 39 2e 5d 2b 29 5c 73 2b 72 28 5b 30 2d 39 2e 5d 2b 29 2f 2c 5f 30 78 34 31 39 61 32 34 28 30 78 32 64 64 29 2c 2f 53 68 6f 63 6b 77 61 76 65 20 46 6c 61 73 68 2f 2c 27 5c 78 32 30 27 2c 5f 30 78 34 31 39 61 32 34 28 30 78 33 34 31 29 2c 30 2e 30 30 31 31 30 36 39 34 30 30 30 37 38 32 34 39 36 33 36 2c 27 70 6c 75 67 69 6e 73 27 2c 5f 30 78 34 31 39 61 32 34 28 30 78 62 31 61 29 2c 6e 75 6c 6c 2c 5f 30 78 34 31 39 61 32 34 28 30 78 37 37 39 29 5d 3b 66 6f 72 Data Ascii: a9),/[^0-9]/g,0.3872427546696784,_0x419a24(0x991),'.',0x1,_0x419a24(0xaf9),0x0,_0x419a24(0xbb1),/([0-9.]+)\s+r([0-9.]+)/,_0x419a24(0x2dd),/Shockwave Flash/,'\x20',_0x419a24(0x341),0.0011069400078249636,'plugins',_0x419a24(0xb1a),null,_0x419a24(0x779)];for
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2f 4d 53 49 45 20 5b 30 2d 39 2e 5d 2b 2f 69 2c 27 62 27 2c 5f 30 78 33 38 34 31 33 63 28 30 78 33 61 39 29 2c 30 78 36 31 32 2c 5f 30 78 33 38 34 31 33 63 28 30 78 31 38 32 29 5d 3b 72 65 74 75 72 6e 21 21 77 69 6e 64 6f 77 5b 5f 30 78 34 38 62 61 38 37 5b 30 78 34 5d 5d 5b 5f 30 78 34 38 62 61 38 37 5b 30 78 36 5d 5d 5b 5f 30 78 34 38 62 61 38 37 5b 30 78 31 5d 5d 28 5f 30 78 34 38 62 61 38 37 5b 30 78 32 5d 29 3b 7d 2c 5f 30 78 31 65 39 34 62 35 5b 5f 30 78 61 35 37 38 32 65 5b 30 78 31 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 61 32 31 38 65 61 3d 5f 30 78 66 35 66 38 38 62 2c 5f 30 78 31 64 39 36 31 37 3d 5b 5f 30 78 61 32 31 38 65 61 28 30 78 31 38 32 29 2c 30 2e 30 31 32 32 30 38 35 31 30 36 36 31 31 37 39 35 36 31 2c 30 2e 36 Data Ascii: /MSIE [0-9.]+/i,'b',_0x38413c(0x3a9),0x612,_0x38413c(0x182)];return!!window[_0x48ba87[0x4]][_0x48ba87[0x6]][_0x48ba87[0x1]](_0x48ba87[0x2]);},_0x1e94b5[_0xa5782e[0x1]]=function(){var _0xa218ea=_0xf5f88b,_0x1d9617=[_0xa218ea(0x182),0.012208510661179561,0.6
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 62 37 64 5b 30 78 65 5d 5d 2c 5f 30 78 33 65 35 32 62 34 3b 7d 28 29 3b 5f 30 78 33 35 65 34 30 66 5b 27 64 65 66 61 75 6c 74 27 5d 3d 5f 30 78 64 65 35 39 32 33 3b 7d 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 39 61 33 30 61 2c 5f 30 78 33 61 33 63 38 65 2c 5f 30 78 31 31 33 62 61 35 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 5f 30 78 35 33 36 63 38 30 3d 61 32 5f 30 78 36 36 30 38 3b 5f 30 78 33 61 33 63 38 65 5b 5f 30 78 35 33 36 63 38 30 28 30 78 33 64 65 29 5d 3d 30 78 31 3b 76 61 72 20 5f 30 78 31 64 64 61 62 61 3d 5f 30 78 31 31 33 62 61 35 28 30 78 30 29 2c 5f 30 78 66 31 37 65 62 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 33 64 33 38 33 65 3d 5f 30 78 35 33 36 63 38 30 2c 5f 30 78 33 39 36 39 64 37 3d 5b 30 78 65 31 Data Ascii: b7d[0xe]],_0x3e52b4;}();_0x35e40f['default']=_0xde5923;},function(_0x59a30a,_0x3a3c8e,_0x113ba5){'use strict';var _0x536c80=a2_0x6608;_0x3a3c8e[_0x536c80(0x3de)]=0x1;var _0x1ddaba=_0x113ba5(0x0),_0xf17eb7=function(){var _0x3d383e=_0x536c80,_0x3969d7=[0xe1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49825	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:17 UTC	557	OUT	GET /scripttemplates/202310.2.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:18 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: 3zwKFeg02sA5dMnkMN3c/A== Last-Modified: Tue, 05 Dec 2023 03:37:34 GMT x-ms-request-id: 9da7b195-801e-001e-0647-27d55b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 44025 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d35daabe8f22-IAD
2024-01-15 23:16:18 UTC	554	IN	Data Raw: 37 63 37 32 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 33 31 30 2e 32 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 33 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 44 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c72/** * onetrust-banner-sdk * v202310.2.0 * by OneTrust LLC * Copyright 2023 */!function(){"use strict";var D=function(e,t){return(D=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 46 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 73 2c 61 2c 6c 29 7b 72 65 74 75 72 6e 20 6e 65 Data Ascii: otype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return ne
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 2c 74 3d 30 2c 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 65 2b 3d 61 72 Data Ascii: l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function q(){for(var e=0,t=0,o=arguments.length;t<o;t++)e+=ar
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 63 65 6f 66 20 4b 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 58 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 24 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 58 28 74 29 7d 63 61 74 63 68 28 65 29 7b 59 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 59 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 6c 75 65 3d 74 2c 58 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 32 3d 3d 3d 65 2e 5f 73 74 61 74 65 26 26 30 3d 3d Data Ascii: ceof K)return t._state=3,t._value=e,void X(t);if("function"==typeof o)return void $((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,X(t)}catch(e){Y(t,e)}var n,r}function Y(e,t){e._state=2,e._value=t,X(e)}function X(e){2===e._state&&0==
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 4b 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4b 3f 74 3a 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 4b 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 28 6f 29 7d 29 7d 2c 4b 2e 72 61 63 65 3d 66 75 6e 63 Data Ascii: eturn void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},K.resolve=function(t){return t&&"object"==typeof t&&t.constructor===K?t:new K(function(e){e(t)})},K.reject=function(o){return new K(function(e,t){t(o)})},K.race=func
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 Data Ascii: e:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 Data Ascii: .initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 3d 22 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 22 2c 28 65 3d 6e 65 3d 6e 65 7c 7c 7b 7d 29 5b 65 2e 50 75 72 70 6f 73 65 3d 31 Data Ascii: e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=te=te\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=oe=oe\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateConsent="UpdateConsent",(e=ne=ne\|\|{})[e.Purpose=1
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 65 5b 65 5b 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 5d 3d 37 5d 3d 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 2c 28 65 3d 67 65 3d 67 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 2e 48 6f 73 74 3d 22 48 6f 73 74 22 2c 65 2e 47 65 6e 56 65 6e 64 6f 72 3d 22 47 65 6e 56 65 6e 22 2c 28 65 3d 79 65 3d 79 65 7c 7c 7b 7d Data Ascii: l"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm",e[e["GPC value changed"]=7]="GPC value changed",(e=ge=ge\|\|{}).Active="1",e.InActive="0",(e=Ce=Ce\|\|{}).Host="Host",e.GenVendor="GenVen",(e=ye=ye\|\|{}
2024-01-15 23:16:18 UTC	1369	IN	Data Raw: 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 28 65 3d 4c 65 3d 4c 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c 49 41 63 74 69 76 65 49 66 4c 65 67 61 6c 42 61 73 69 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 63 6f 6f 6b 69 65 73 3d 22 63 6f 6f 6b 69 65 73 22 2c 65 2e 76 65 6e 64 6f 72 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 56 65 3d 56 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 43 43 50 41 3d 22 43 43 50 41 22 2c 65 2e 49 41 42 32 3d 22 49 41 42 32 22 2c 65 2e 49 41 42 32 56 32 3d 22 49 41 42 32 56 32 22 2c Data Ascii: \|{}).granted="granted",e.denied="denied",(e=Le=Le\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="LIActiveIfLegalBasis",(e=_e=_e\|\|{}).cookies="cookies",e.vendors="vendors",(e=Ve=Ve\|\|{}).GDPR="GDPR",e.CCPA="CCPA",e.IAB2="IAB2",e.IAB2V2="IAB2V2",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49826	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/eb60141d.11bec58c.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 215020 Connection: close Last-Modified: Fri, 12 Jan 2024 13:21:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: FlmfvjlRoSBDOj8_2C44RDs_tZ9gr6ca Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 15:17:35 GMT ETag: "ce1b060a535136eefe1c7d1a63051046" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Wgq-Mqs8bahL-fC1IgMbPGE3Z9OAsTAG8uvUz-qu00H5Exn6ZwcOwA== Age: 28724 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 65 62 36 30 31 34 31 64 2e 31 31 62 65 63 35 38 63 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 65 62 36 30 31 34 31 64 22 5d 2c 7b 61 36 63 39 31 62 39 37 3a 66 75 6e 63 74 69 6f 6e 28 41 2c 67 2c 6e 29 7b 76 61 72 20 65 3d 7b 22 2e 2f 61 64 2e 70 6e 67 22 Data Ascii: /! For license information please see eb60141d.11bec58c.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["eb60141d"],{a6c91b97:function(A,g,n){var e={"./ad.png"
2024-01-15 23:16:18 UTC	10463	IN	Data Raw: 6c 61 63 65 28 22 3c 53 49 5a 45 3e 22 2c 69 5b 22 31 78 22 5d 29 2c 22 32 78 22 3a 41 2e 72 65 70 6c 61 63 65 28 22 3c 53 49 5a 45 3e 22 2c 69 5b 22 32 78 22 5d 29 7d 3a 6e 75 6c 6c 7d 3b 67 2e 5a 3d 28 41 2c 67 2c 6e 29 3d 3e 41 26 26 6e 2b 41 2e 72 65 70 6c 61 63 65 28 22 3c 53 49 5a 45 3e 22 2c 67 29 7d 2c 22 35 63 34 65 64 61 35 65 22 3a 66 75 6e 63 74 69 6f 6e 28 41 2c 67 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 67 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 7d 2c 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 6c 65 74 20 65 3d 66 75 6e 63 74 69 6f 6e 28 41 29 7b 72 65 74 75 72 6e 20 41 2e 49 6e 64 65 78 51 6d 61 62 44 65 73 6b 74 6f 70 3d 22 49 6e 64 65 78 51 6d 61 62 44 65 Data Ascii: lace("<SIZE>",i["1x"]),"2x":A.replace("<SIZE>",i["2x"])}:null};g.Z=(A,g,n)=>A&&n+A.replace("<SIZE>",g)},"5c4eda5e":function(A,g,n){"use strict";n.d(g,{J:function(){return t},y:function(){return e}});let e=function(A){return A.IndexQmabDesktop="IndexQmabDe
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2f 2f 32 62 2f 2f 31 76 2f 2f 30 66 37 2b 6d 48 2f 2f 77 6a 2f 2f 78 48 36 2b 42 58 32 38 30 76 30 37 69 48 76 36 45 6a 74 37 51 76 70 34 59 58 66 7a 70 50 57 78 6f 50 65 77 34 48 5a 77 4a 44 6c 78 44 54 57 77 31 58 4e 76 6d 4c 51 75 32 7a 4e 74 70 4c 59 73 70 48 6d 75 43 6a 50 74 32 72 54 73 59 44 61 72 6f 50 4d 72 35 4c 76 71 30 58 76 70 6d 6e 6a 72 55 6e 6d 71 30 50 7a 70 45 50 6a 71 54 4c 43 71 6f 58 74 70 78 2f 6b 6e 48 6a 68 6d 6e 2f 77 6d 47 75 2b 70 58 2b 38 70 6e 4f 39 70 49 48 6b 6d 7a 54 7a 69 61 44 71 6d 53 44 69 6b 7a 44 79 67 70 72 72 6a 78 6d 54 6c 38 6d 4e 6b 63 58 79 64 35 48 77 63 6f 32 43 68 38 44 77 61 34 6a 77 5a 34 52 39 67 72 35 34 66 72 7a 75 57 33 74 30 65 62 6c 72 63 62 58 73 55 48 42 70 62 37 54 73 53 57 7a 72 51 47 52 63 59 71 Data Ascii: //2b//1v//0f7+mH//wj//xH6+BX280v07iHv6Ejt7Qvp4YXfzpPWxoPew4HZwJDlxDTWw1XNvmLQu2zNtpLYspHmuCjPt2rTsYDaroPMr5Lvq0XvpmnjrUnmq0PzpEPjqTLCqoXtpx/knHjhmn/wmGu+pX+8pnO9pIHkmzTziaDqmSDikzDygprrjxmTl8mNkcXyd5Hwco2Ch8Dwa4jwZ4R9gr54frzuW3t0eblrcbXsUHBpb7TsSWzrQGRcYq
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 6d 74 43 6e 47 73 7a 6e 32 67 34 6e 47 6b 7a 6d 57 59 6e 6d 32 41 6a 6d 56 33 55 4c 6a 50 66 4b 6a 44 66 4a 79 7a 53 4b 53 2f 52 4a 69 7a 64 49 53 62 51 49 79 6a 64 48 79 54 4e 48 79 52 47 7a 52 33 46 41 41 41 41 42 58 52 53 54 6c 4d 41 45 53 49 7a 52 4a 54 64 52 48 77 41 41 41 42 64 53 55 52 42 56 42 67 5a 64 63 47 42 45 63 49 77 44 41 54 42 2b 37 4d 4a 2f 56 63 5a 65 6d 43 49 4b 55 44 53 72 67 78 6b 49 41 4e 4a 43 37 4e 62 4d 62 51 69 41 78 6e 49 51 4b 36 73 49 69 38 6b 4c 51 51 62 51 66 5a 2b 46 31 73 45 55 79 67 53 47 6b 48 57 31 56 6a 49 77 6f 4b 46 4a 42 51 4a 49 74 38 43 45 61 2b 47 65 4f 35 50 34 7a 36 65 35 39 64 34 6a 70 77 57 4d 76 67 44 50 46 46 59 4d 5a 30 56 38 35 41 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 3d 22 7d 2c 61 36 37 35 37 Data Ascii: mtCnGszn2g4nGkzmWYnm2AjmV3ULjPfKjDfJyzSKS/RJizdISbQIyjdHyTNHyRGzR3FAAAABXRSTlMAESIzRJTdRHwAAABdSURBVBgZdcGBEcIwDATB+7MJ/VcZemCIKUDSrgxkIANJC7NbMbQiAxnIQK6sIi8kLQQbQfZ+F1sEUygSGkHW1VjIwoKFJBQJIt8CEa+GeO5P4z6e59d4jpwWMvgDPFFYMZ0V85AAAAAASUVORK5CYII="},a6757
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 31 45 6f 57 76 47 56 53 74 4c 6b 39 6e 31 74 51 78 51 5a 50 6b 49 30 4b 49 72 56 67 57 6c 52 67 6b 57 77 30 41 6c 43 6e 53 58 33 54 33 31 4a 58 51 61 42 35 77 65 79 37 64 30 47 4e 56 59 78 48 31 30 4e 67 56 77 68 57 49 4d 5a 52 77 39 52 59 37 71 58 78 6c 49 4d 4b 47 33 61 43 43 4a 36 35 45 4b 44 51 66 59 74 4f 61 79 67 73 6e 38 53 69 56 38 4c 4f 6a 67 57 73 72 57 6c 38 7a 65 4a 43 51 76 38 69 39 33 6f 56 43 6d 49 51 43 42 41 51 46 34 50 65 74 62 62 51 44 32 6e 50 69 61 31 34 34 4a 67 52 6f 4e 6d 35 66 78 39 70 64 4f 48 7a 36 4e 30 6f 73 4d 42 32 30 44 51 56 54 4e 37 73 78 67 54 48 79 65 33 30 37 76 67 4f 59 42 70 49 63 6a 6a 34 66 68 38 41 4c 7a 43 64 6e 6a 57 63 50 6b 6d 43 4d 65 68 35 51 6a 77 73 6c 65 63 73 44 30 4d 36 73 71 43 4d 4e 64 6c 51 2b 6b 30 Data Ascii: 1EoWvGVStLk9n1tQxQZPkI0KIrVgWlRgkWw0AlCnSX3T31JXQaB5wey7d0GNVYxH10NgVwhWIMZRw9RY7qXxlIMKG3aCCJ65EKDQfYtOaygsn8SiV8LOjgWsrWl8zeJCQv8i93oVCmIQCBAQF4PetbbQD2nPia144JgRoNm5fx9pdOHz6N0osMB20DQVTN7sxgTHye307vgOYBpIcjj4fh8ALzCdnjWcPkmCMeh5QjwslecsD0M6sqCMNdlQ+k0
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 6f 6c 70 72 34 62 74 6a 6c 44 76 69 47 72 41 6b 59 62 74 6a 52 2f 79 67 33 61 44 6f 6f 54 73 67 34 62 73 69 55 4a 62 72 48 31 65 71 34 44 74 66 6f 4c 6a 67 59 47 78 6a 6e 37 72 67 46 37 72 66 6d 37 72 66 48 68 76 6f 48 76 76 65 6e 66 62 66 6e 72 71 65 58 7a 72 67 53 52 51 70 6e 54 70 65 31 48 70 65 47 7a 73 66 54 62 71 65 6c 35 4e 70 58 4c 73 64 58 6a 71 64 58 69 66 69 33 5a 6c 6c 4d 74 70 6b 63 4c 71 65 79 44 73 65 78 31 48 6f 32 33 70 63 31 39 62 6e 48 44 71 64 79 66 4f 64 6e 44 70 63 30 50 71 64 44 4e 48 6e 6d 78 66 6a 63 52 70 69 72 72 70 63 79 46 6b 69 62 39 61 6a 4d 62 6f 61 32 31 64 6c 57 71 49 68 32 74 6a 69 4c 35 43 6d 32 6a 77 5a 6d 31 56 69 63 56 47 6c 32 58 6f 61 46 4b 4f 65 35 39 69 68 4c 56 72 67 62 53 51 66 6d 58 6e 61 45 52 62 68 4c 37 6f Data Ascii: olpr4btjlDviGrAkYbtjR/yg3aDooTsg4bsiUJbrH1eq4DtfoLjgYGxjn7rgF7rfm7rfHhvoHvvenfbfnrqeXzrgSRQpnTpe1HpeGzsfTbqel5NpXLsdXjqdXifi3ZllMtpkcLqeyDsex1Ho23pc19bnHDqdyfOdnDpc0PqdDNHnmxfjcRpirrpcyFkib9ajMboa21dlWqIh2tjiL5Cm2jwZm1VicVGl2XoaFKOe59ihLVrgbSQfmXnaERbhL7o
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 41 41 41 44 2f 2f 2f 2f 34 2b 2f 7a 35 2b 66 6e 76 37 2b 2f 4e 34 2b 37 48 34 4f 7a 44 33 2b 71 2b 33 4f 69 37 32 65 69 30 31 2b 61 39 31 65 43 6c 7a 75 47 65 79 39 36 59 79 4e 75 4f 77 74 69 4b 76 39 65 46 76 64 61 4a 75 4e 4e 38 75 4e 4a 2b 74 39 47 43 74 4e 42 7a 74 63 35 79 71 73 70 6f 72 63 78 79 71 73 6c 72 70 38 64 5a 70 63 5a 62 6d 73 42 53 6d 62 6c 4b 6d 72 31 51 6c 62 31 48 6c 62 31 43 6b 62 70 47 6a 37 6b 38 6b 62 59 30 6b 62 70 41 6a 4c 63 6d 69 62 55 6c 69 62 55 77 68 4c 4d 79 67 61 38 75 66 61 73 70 65 71 6b 69 65 71 77 53 65 71 77 59 64 4b 67 61 63 4b 41 53 63 4b 59 4c 62 4b 4d 4b 61 35 78 4b 58 33 2f 76 41 41 41 41 42 58 52 53 54 6c 4d 41 45 53 49 7a 52 4a 54 64 52 48 77 41 41 41 43 7a 53 55 52 42 56 48 6a 61 72 64 46 62 45 34 46 51 46 49 Data Ascii: AAAD////4+/z5+fnv7+/N4+7H4OzD3+q+3Oi72ei01+a91eClzuGey96YyNuOwtiKv9eFvdaJuNN8uNJ+t9GCtNBztc5yqsporcxyqslrp8dZpcZbmsBSmblKmr1Qlb1Hlb1CkbpGj7k8kbY0kbpAjLcmibUlibUwhLMyga8ufaspeqkieqwSeqwYdKgacKAScKYLbKMKa5xKX3/vAAAABXRSTlMAESIzRJTdRHwAAACzSURBVHjardFbE4FQFI
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 67 41 41 41 41 59 43 41 4d 41 41 41 44 58 71 63 33 4b 41 41 41 42 46 31 42 4d 56 45 58 2f 2f 2f 38 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 44 2f 2f 2f 2f 32 39 76 62 2f 36 75 76 2f 31 74 6e 30 75 72 33 30 73 37 62 7a 73 4c 4c 79 71 4b 76 78 6f 71 58 77 6e 4a 2f 79 6a 70 48 66 6b 70 58 73 67 34 62 7a 66 6f 4c 71 65 58 33 79 64 6e 71 68 6a 49 32 4a 69 59 6e 6f 62 58 44 77 61 6d 2f 6f 61 6d 36 71 64 33 6e 45 63 58 53 42 67 6f 4c 62 61 57 30 62 6f 6d 49 6b 6e 47 45 71 6d 32 4d 5a 6e 32 44 72 58 6d 49 6b 6d 6c 33 6d 58 32 4d 53 6e 6c 37 6d 58 57 45 71 6c 56 38 66 6c 31 6f 56 6d 6c 6f 6f 6b 31 33 6d 57 6c 37 76 56 31 30 59 6c 46 55 56 6c 46 68 79 63 6e 4c 6a 56 46 67 33 68 31 Data Ascii: ,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAMAAADXqc3KAAABF1BMVEX///8AAAAAAAAAAAAAAAD////29vb/6uv/1tn0ur30s7bzsLLyqKvxoqXwnJ/yjpHfkpXsg4bzfoLqeX3ydnqhjI2JiYnobXDwam/oam6qd3nEcXSBgoLbaW0bomIknGEqm2MZn2DrXmIkml3mX2MSnl7mXWEqlV8fl1oVmlook13mWl7vV10YlFUVlFhycnLjVFg3h1
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 64 4d 52 48 4e 4c 43 68 58 6b 62 52 6f 58 51 51 74 77 76 35 38 2b 36 42 39 45 47 4a 70 4e 38 75 35 7a 30 6d 4c 77 73 68 4e 30 50 50 41 76 78 47 45 64 5a 79 49 41 75 4c 34 77 57 7a 66 47 45 46 43 47 72 4c 42 69 71 42 7a 4b 41 72 55 63 6b 2b 6a 47 64 39 61 37 51 49 55 58 4e 49 4c 2f 44 46 66 37 47 59 76 71 30 41 78 64 70 41 52 64 71 38 63 48 35 71 39 5a 75 35 58 59 4d 58 75 33 4b 54 39 32 39 48 57 6a 4b 58 4e 51 57 67 39 4c 30 39 48 43 67 39 4a 72 39 45 63 42 53 7a 55 64 77 63 75 55 57 61 78 51 35 46 35 65 2b 2f 36 34 4f 34 52 36 4a 7a 34 68 57 79 55 34 35 6d 31 4b 4a 42 63 32 6e 73 50 54 50 2b 73 72 41 4b 62 50 37 6d 74 35 77 49 46 71 6a 78 38 39 6d 67 63 39 31 4f 4d 78 4e 4d 69 78 4e 52 51 49 43 57 6c 36 41 37 72 4b 65 4a 65 4a 31 43 41 52 62 47 6c 49 39 Data Ascii: dMRHNLChXkbRoXQQtwv58+6B9EGJpN8u5z0mLwshN0PPAvxGEdZyIAuL4wWzfGEFCGrLBiqBzKArUck+jGd9a7QIUXNIL/DFf7GYvq0AxdpARdq8cH5q9Zu5XYMXu3KT929HWjKXNQWg9L09HCg9Jr9EcBSzUdwcuUWaxQ5F5e+/64O4R6Jz4hWyU45m1KJBc2nsPTP+srAKbP7mt5wIFqjx89mgc91OMxNMixNRQICWl6A7rKeJeJ1CARbGlI9
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 76 37 2b 2f 76 35 65 62 6b 35 4f 54 73 34 4f 48 65 33 74 37 58 32 4e 6a 75 6c 4a 62 74 6a 59 2f 73 67 34 66 73 66 34 4c 72 65 58 33 71 64 58 6e 6f 62 58 44 70 61 6d 37 6e 58 32 50 6d 58 6d 48 6d 57 46 7a 6a 55 31 66 6d 55 46 58 67 54 46 44 65 52 6b 76 6a 51 6b 66 64 51 6b 66 61 50 6b 50 58 4f 44 37 67 4e 6a 7a 67 4d 7a 6a 57 4e 44 6e 67 4c 7a 58 55 4c 7a 54 66 4b 6a 44 66 4a 79 7a 53 4b 7a 48 65 49 79 6e 52 4a 69 7a 51 49 79 6a 64 48 79 54 4e 48 79 54 70 64 68 70 4e 41 41 41 41 42 58 52 53 54 6c 4d 41 45 53 49 7a 52 4a 54 64 52 48 77 41 41 41 43 48 53 55 52 42 56 42 67 5a 64 63 48 42 63 63 49 77 41 45 58 42 39 35 38 55 68 36 47 42 39 4e 39 55 30 6b 6b 4f 52 6b 45 4d 4d 46 4a 38 6b 48 66 6c 68 4a 79 51 45 35 49 6c 54 50 32 34 58 4f 72 62 31 37 38 59 53 4d Data Ascii: v7+/v5ebk5OTs4OHe3t7X2NjulJbtjY/sg4fsf4LreX3qdXnobXDpam7nX2PmXmHmWFzjU1fmUFXgTFDeRkvjQkfdQkfaPkPXOD7gNjzgMzjWNDngLzXULzTfKjDfJyzSKzHeIynRJizQIyjdHyTNHyTpdhpNAAAABXRSTlMAESIzRJTdRHwAAACHSURBVBgZdcHBccIwAEXB958Uh6GB9N9U0kkORkEMMFJ8kHflhJyQE5IlTP24XOrb178YSM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49827	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10721 Connection: close Date: Mon, 15 Jan 2024 20:21:27 GMT Last-Modified: Mon, 15 Jan 2024 20:10:57 GMT ETag: "449f8abd0585d68506a1e46ad4a8bbad" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HrQZAFmPje397T7kC9Z_Niv7jdtwFdr Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vbHzHS_NPGnY_p_mwVVZVAotK429XMP12X52B3aRRwCEC-4eqTVS9g== Age: 10492 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	10721	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 36 61 37 38 61 63 62 22 5d 2c 7b 22 30 37 33 39 30 64 64 62 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 41 29 7b 41 2e 72 28 74 29 2c 41 2e 64 28 74 2c 7b 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 7d 29 3b 76 61 72 20 6e 2c 61 2c 45 3d 41 28 22 65 61 64 37 31 65 62 30 22 29 2c 6c 3d 41 2e 6e 28 45 29 2c 69 3d 41 28 22 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c6a78acb"],{"07390ddb":function(e,t,A){A.r(t),A.d(t,{default:function(){return R}});var n,a,E=A("ead71eb0"),l=A.n(E),i=A("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49828	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 21613 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: FSpeoflwTC18Opc6yNd_vAzlp6byL2KT Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 15:40:33 GMT ETag: "eefe1bd68506ecbaf7afcee3ddccc7e4" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vdJ-rbTyJ10GKL6FLEtJoxl2DDuhS901p5QGbUSlYnqePEEPGoRqjA== Age: 27346 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	15698	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 35 30 61 32 64 66 63 22 5d 2c 7b 22 32 32 62 30 66 33 37 63 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 61 3d 74 28 22 33 36 37 39 34 36 38 65 22 29 3b 6e 2e 5a 3d 61 2e 5a 7d 2c 22 34 33 62 65 64 64 38 34 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f50a2dfc"],{"22b0f37c":function(e,n,t){var a=t("3679468e");n.Z=a.Z},"43bedd84":function(e,n,t){t.d(n,{p:function(){return
2024-01-15 23:16:18 UTC	5915	IN	Data Raw: 3a 6e 2c 74 69 74 6c 65 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 68 65 61 64 65 72 22 2c 73 75 62 74 69 74 6c 65 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 73 75 62 68 65 61 64 65 72 22 2c 69 6d 61 67 65 5f 75 72 6c 3a 5b 22 67 65 6e 69 75 73 5f 6c 6f 67 6f 22 5d 2c 69 6d 61 67 65 5f 64 65 73 69 67 6e 3a 5b 22 69 63 6f 6e 22 5d 2c 62 61 6e 6e 65 72 5f 61 63 74 69 6f 6e 3a 5b 7b 61 63 74 69 6f 6e 5f 69 6e 64 65 78 3a 30 2c 61 63 74 69 6f 6e 5f 75 72 6c 3a 65 2c 61 63 74 69 6f 6e 5f 74 65 78 74 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 63 74 61 22 2c 61 63 74 69 6f 6e 5f 74 79 70 65 3a 22 43 54 41 5f 72 65 64 69 72 65 63 74 22 7d 5d Data Ascii: :n,title:"gex_m_fusion_index_banner_header",subtitle:"gex_m_fusion_index_banner_subheader",image_url:["genius_logo"],image_design:["icon"],banner_action:[{action_index:0,action_url:e,action_text:"gex_m_fusion_index_banner_cta",action_type:"CTA_redirect"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49829	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	249	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:18 GMT Content-Type: text/javascript Content-Length: 92 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d35eaf0407f2-IAD
2024-01-15 23:16:18 UTC	92	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49831	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/a6a21c13.3e4975b8.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 25662 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: mWj1MWDOaLp504oq_2FgZJvad26ighN4 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 20:05:18 GMT ETag: "6c724cb3ab9cbeccff5d0251367f5e7d" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: rQzpVSwDCnp-K6lnF2mBrFOa26QwDpvlOa_JdGeWXB0jIiVcMdgaRg== Age: 23029 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	15698	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 61 36 61 32 31 63 31 33 22 5d 2c 7b 22 33 34 38 32 37 63 36 34 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 4d 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 74 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 76 61 72 20 69 3d 74 28 22 65 61 64 37 31 65 62 30 22 29 3b 6c 65 74 20 61 3d Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6a21c13"],{"34827c64":function(e,n,t){t.d(n,{M6:function(){return a},t0:function(){return c}});var i=t("ead71eb0");let a=
2024-01-15 23:16:18 UTC	9964	IN	Data Raw: 2e 31 31 32 30 30 38 32 2d 35 2e 32 31 33 30 31 30 37 2e 32 32 36 36 33 33 37 2d 2e 33 36 38 32 39 32 34 2e 31 32 36 36 34 38 33 2d 2e 36 32 32 37 34 39 31 2d 2e 32 39 33 32 39 30 35 2d 2e 37 36 33 33 36 39 36 6c 2d 33 2e 36 32 39 34 37 32 33 2d 31 2e 35 32 36 37 33 39 32 63 2d 2e 33 36 36 36 31 33 33 2d 2e 31 36 37 34 30 35 38 2d 2e 36 33 33 32 34 31 33 2d 2e 31 32 37 32 32 38 34 2d 2e 38 30 33 32 31 36 36 2e 31 32 37 32 32 38 33 2d 31 2e 30 31 33 31 38 35 38 20 31 2e 35 38 33 36 35 36 39 2d 32 2e 34 37 32 39 37 33 35 20 32 2e 33 37 33 38 31 31 34 2d 34 2e 33 38 36 30 32 38 38 20 32 2e 33 37 33 38 31 31 34 2d 31 2e 34 30 36 34 36 32 31 20 30 2d 32 2e 35 36 39 36 32 36 32 2d 2e 33 39 35 30 37 37 32 2d 33 2e 34 38 32 38 32 36 37 2d 31 2e 31 38 35 32 33 31 Data Ascii: .1120082-5.2130107.2266337-.3682924.1266483-.6227491-.2932905-.7633696l-3.6294723-1.5267392c-.3666133-.1674058-.6332413-.1272284-.8032166.1272283-1.0131858 1.5836569-2.4729735 2.3738114-4.3860288 2.3738114-1.4064621 0-2.5696262-.3950772-3.4828267-1.185231

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49832	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 65226 Connection: close Last-Modified: Wed, 10 Jan 2024 15:06:27 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: PMsq1Kea06y.hT_gNJUqalZtqIMjtOwU Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 21:09:18 GMT ETag: "2a4be84facf3e21bb4a9ebb12a10a92e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 7pPaiaOzp0y0CoS3AKcdDr1Uu1tn8jmJiAxJs-T3JyvUpKaVV2CFhA== Age: 23029 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 66 35 64 30 65 32 65 37 2e 35 63 64 33 38 66 64 36 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 35 64 30 65 32 65 37 22 5d 2c 7b 61 66 31 65 32 62 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 Data Ascii: /! For license information please see f5d0e2e7.5cd38fd6.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f5d0e2e7"],{af1e2b38:function(e,t,n){"use strict";n.d(
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2c 5b 22 54 4e 44 22 2c 33 5d 2c 5b 22 54 57 44 22 2c 30 5d 2c 5b 22 55 47 58 22 2c 30 5d 2c 5b 22 56 4e 44 22 2c 30 5d 2c 5b 22 56 55 56 22 2c 30 5d 2c 5b 22 58 41 46 22 2c 30 5d 2c 5b 22 58 4f 46 22 2c 30 5d 2c 5b 22 58 50 46 22 2c 30 5d 2c 5b 22 52 55 42 22 2c 30 5d 5d 29 2c 41 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 43 45 49 4c 3a 22 43 45 49 4c 22 2c 46 4c 4f 4f 52 3a 22 46 4c 4f 4f 52 22 7d 29 2c 44 3d 6e 65 77 20 4d 61 70 28 5b 5b 22 41 46 41 22 2c 41 2e 43 45 49 4c 5d 2c 5b 22 42 49 46 22 2c 41 2e 46 4c 4f 4f 52 5d 2c 5b 22 42 59 52 22 2c 41 2e 46 4c 4f 4f 52 5d 2c 5b 22 43 4c 50 22 2c 41 2e 46 4c 4f 4f 52 5d 2c 5b 22 44 4a 46 22 2c 41 2e 46 4c 4f 4f 52 5d 2c 5b 22 45 43 53 22 2c 41 2e 46 4c 4f 4f 52 5d 2c 5b 22 47 4e 46 22 2c 41 2e 46 4c Data Ascii: ,["TND",3],["TWD",0],["UGX",0],["VND",0],["VUV",0],["XAF",0],["XOF",0],["XPF",0],["RUB",0]]),A=Object.freeze({CEIL:"CEIL",FLOOR:"FLOOR"}),D=new Map([["AFA",A.CEIL],["BIF",A.FLOOR],["BYR",A.FLOOR],["CLP",A.FLOOR],["DJF",A.FLOOR],["ECS",A.FLOOR],["GNF",A.FL
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 7d 7d 29 29 29 29 29 29 7d 2c 53 65 3d 7b 62 61 64 67 65 43 6f 6e 74 61 69 6e 65 72 3a 22 65 63 32 30 64 33 38 66 61 36 22 2c 6d 65 64 69 75 6d 3a 22 61 39 64 62 34 39 30 64 33 31 22 2c 73 6d 61 6c 6c 3a 22 65 37 66 35 32 30 33 63 65 61 22 2c 6c 61 72 67 65 3a 22 65 37 34 34 36 65 66 64 32 34 22 2c 62 61 64 67 65 52 69 6e 67 43 6f 6e 74 61 69 6e 65 72 3a 22 64 38 33 39 39 36 38 66 64 32 22 2c 72 69 6e 67 3a 22 64 36 39 37 31 63 30 39 31 38 22 2c 62 6c 75 65 3a 22 61 66 39 66 34 32 32 63 65 65 22 2c 70 72 6f 67 72 65 73 73 3a 22 64 36 66 38 61 61 36 64 34 30 22 2c 67 6f 6c 64 65 6e 3a 22 65 65 64 39 61 37 35 61 35 62 22 2c 74 65 78 74 3a 22 63 63 64 63 66 65 35 37 65 34 22 2c 62 61 64 67 65 43 6f 6d 70 6c 65 74 65 64 4e 75 6d 62 65 72 3a 22 61 36 37 37 37 Data Ascii: }}))))))},Se={badgeContainer:"ec20d38fa6",medium:"a9db490d31",small:"e7f5203cea",large:"e7446efd24",badgeRingContainer:"d839968fd2",ring:"d6971c0918",blue:"af9f422cee",progress:"d6f8aa6d40",golden:"eed9a75a5b",text:"ccdcfe57e4",badgeCompletedNumber:"a6777
2024-01-15 23:16:18 UTC	14808	IN	Data Raw: 22 63 65 6e 74 65 72 22 7d 2c 63 65 28 6e 2e 73 75 62 74 69 74 6c 65 2c 7b 22 76 69 70 2d 62 6f 6c 64 22 3a 77 65 2e 76 69 70 42 6f 6c 64 7d 29 29 29 29 29 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 2e 53 74 61 63 6b 2e 49 74 65 6d 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 65 28 29 28 61 26 26 77 65 2e 6d 64 6f 74 41 63 74 69 6f 6e 42 61 72 2c 61 26 26 75 26 26 77 65 5b 22 6d 64 6f 74 41 63 74 69 6f 6e 42 61 72 2d 2d 6e 6f 50 61 64 64 69 6e 67 42 6f 74 74 6f 6d 22 5d 29 7d 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 2e 53 74 61 63 6b 2c 7b 67 61 70 3a 61 3f 30 3a 33 7d 2c 6e 2e 63 74 61 26 26 63 29 29 29 29 29 7d 2c 55 65 3d 6e 28 22 61 66 31 65 32 62 33 38 22 29 3b 63 6f 6e 73 74 20 56 65 3d 28 30 2c 61 2e 63 72 65 61 74 65 Data Ascii: "center"},ce(n.subtitle,{"vip-bold":we.vipBold}))))),i().createElement(s.Stack.Item,{className:ae()(a&&we.mdotActionBar,a&&u&&we["mdotActionBar--noPaddingBottom"])},i().createElement(s.Stack,{gap:a?0:3},n.cta&&c)))))},Ue=n("af1e2b38");const Ve=(0,a.create
2024-01-15 23:16:18 UTC	1266	IN	Data Raw: 6c 6c 5f 30 22 2b 6e 5d 3d 72 28 47 5b 22 64 61 79 5f 6e 61 6d 65 5f 74 69 6c 6c 22 2b 6e 5d 29 2c 6c 29 2c 47 29 7d 66 75 6e 63 74 69 6f 6e 20 56 28 65 2c 74 29 7b 69 66 28 21 65 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 69 31 38 6e 20 6f 62 6a 65 63 74 20 70 72 6f 76 69 64 65 64 22 29 3b 76 61 72 20 6e 3d 74 2e 74 69 6d 65 2c 72 3d 74 2e 74 69 6d 65 55 6e 74 69 6c 2c 6f 3d 74 2e 62 65 67 69 6e 4d 61 72 6b 65 72 2c 73 3d 76 6f 69 64 20 30 3d 3d 3d 6f 3f 22 28 22 3a 6f 2c 63 3d 74 2e 65 6e 64 4d 61 72 6b 65 72 2c 6d 3d 76 6f 69 64 20 30 3d 3d 3d 63 3f 22 29 22 3a 63 2c 75 3d 74 2e 66 6f 72 6d 2c 67 3d 74 2e 64 61 74 65 2c 5f 3d 74 2e 64 61 74 65 55 6e 74 69 6c 2c 70 3d 28 30 2c 61 2e 70 69 29 28 7b 62 65 67 69 6e 5f 6d 61 72 6b 65 72 Data Ascii: ll_0"+n]=r(G["day_name_till"+n]),l),G)}function V(e,t){if(!e)throw new Error("No i18n object provided");var n=t.time,r=t.timeUntil,o=t.beginMarker,s=void 0===o?"(":o,c=t.endMarker,m=void 0===c?")":c,u=t.form,g=t.date,_=t.dateUntil,p=(0,a.pi)({begin_marker

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49834	13.32.208.75	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	1324	OUT	GET /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8hqoqwQz32%2FIzCaCuLTELChSC9TNrVNCL5xVyAuLcubuE3xVNh6bqsNwl21BTlrN%2FiqMZ1i8Fmu1B1CkYILi3qTqVCwJ6mHeiztlCK1lVV6cEAGy6tVkBr73YolZGRRUovJU3HLL3rwWCiyp3qURzt; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6IjE0ZDVmN2NjLTllNmMtNDgzNi04YzkzLWIxNDVjMTgyZGE0MSJ9fQ; bkng_sso_ses=e30
2024-01-15 23:16:18 UTC	2059	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:18 GMT content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=cc44a3a1aa17007d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgShR9GX5SBfS4aI2tW2n5tOKAGiBz8eZ5mKMfnhusmfUPJNt7O-iJFxXjIzmP_FduA content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=cc44a3a1aa17007d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgShR9GX5SBfS4aI2tW2n5tOKAGiBz8eZ5mKMfnhusmfUPJNt7O-iJFxXjIzmP_FduA; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-E1frpq5MaUspQjL' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 7610b91e2653cd801af5fb6517906ed4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: kkNCjK929zM5IY5QGwZ87j2Bg37Wsu-clblLWhplsvALdiFKanyNDw==
2024-01-15 23:16:18 UTC	1638	IN	Data Raw: 36 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 65f<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-01-15 23:16:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49833	142.251.111.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	868	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&gjid=1707741665&_gid=1111547412.1705360577&_u=aGBAgAIJAAAAAGgMIAC~&z=1566906621 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	593	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.booking.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Mon, 15 Jan 2024 23:16:18 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:18 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49835	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/43e47265.bbef290e.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 122058 Connection: close Last-Modified: Sat, 13 Jan 2024 05:17:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XdXi26MC2aztspG0SAQoC9Xcf9l7f9TA Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 18:20:00 GMT ETag: "15334a0df0f69c8c9870ec8b81e0197d" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: IGw0cMEZOzAuQK_GJqvxMclTnIr44Ccwie-Z-AQJllCNELrnriRtcw== Age: 17779 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 65 34 37 32 36 35 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 64 28 6e 2c 7b 42 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 74 3d 69 28 22 64 63 36 64 32 38 66 66 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 74 2e 67 65 74 52 65 71 75 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["43e47265"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequ
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 30 39 38 39 32 33 36 22 29 3b 6c 65 74 20 4d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 45 78 70 61 6e 64 3d 22 45 78 70 61 6e 64 22 2c 65 2e 43 6f 6c 6c 61 70 73 65 3d 22 43 6f 6c 6c 61 70 73 65 22 2c 65 2e 43 54 41 3d 22 43 54 41 22 2c 65 7d 28 7b 7d 29 3b 63 6f 6e 73 74 20 42 3d 7b 5b 74 2e 48 45 41 44 45 52 5d 3a 7b 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 3a 22 32 2e 30 2e 30 22 2c 63 6f 6d 70 6f 6e 65 6e 74 5f 61 63 74 69 6f 6e 5f 63 6c 69 63 6b 65 64 3a 22 31 2e 30 2e 30 22 2c 63 6f 6d 70 6f 6e 65 6e 74 5f 73 63 72 6f 6c 6c 65 64 3a 22 31 2e 30 2e 30 22 7d 2c 5b 74 2e 46 4f 4f 54 45 52 5d 3a 7b 7d 2c 5b 74 2e 47 4c 4f 42 41 4c 5f 41 4c 45 52 54 5d 3a 7b 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 3a 22 32 2e 30 2e Data Ascii: 0989236");let M=function(e){return e.Expand="Expand",e.Collapse="Collapse",e.CTA="CTA",e}({});const B={[t.HEADER]:{component_served:"2.0.0",component_action_clicked:"1.0.0",component_scrolled:"1.0.0"},[t.FOOTER]:{},[t.GLOBAL_ALERT]:{component_served:"2.0.
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 72 6f 6c 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 50 61 74 68 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 71 75 65 72 79 50 61 72 61 6d 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c Data Ascii: lectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"role"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"urlPath"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"queryParams"},arguments:[],directives:[],
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 45 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 65 49 61 44 4a 64 44 42 4b 43 60 29 2c 6e 3d 28 30 2c 52 65 2e 5a 29 28 28 28 65 2c 6e 29 3d 3e 7b 76 61 72 20 69 3b 6c 65 74 7b 65 72 72 6f 72 3a 74 2c 6c 6f 61 64 69 6e 67 3a 61 7d 3d 6e 3b 72 65 74 75 72 6e 20 74 7c 7c 61 3f 5b 5d 3a 6f 65 28 6e 75 6c 6c 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 7c 7c 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 72 65 67 69 6f 6e 73 29 7d 29 2c 65 29 3b 72 65 74 75 72 6e 20 65 3f 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 41 65 28 29 2c 7b 72 65 67 69 6f 6e 49 64 3a 22 49 6e 64 65 78 50 61 67 65 22 7d 29 3a 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e Data Ascii: EeCFZAcbRbROfLMeIaDJdDBKC`),n=(0,Re.Z)(((e,n)=>{var i;let{error:t,loading:a}=n;return t\|\|a?[]:oe(null===e\|\|void 0===e\|\|null===(i=e.merchComponents)\|\|void 0===i?void 0:i.regions)}),e);return e?r().createElement(Ae(),{regionId:"IndexPage"}):r().createElemen
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 65 5c 6e 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 69 64 5c 6e 20 20 20 20 20 20 20 20 20 20 73 6d 61 6c 6c 49 6d 61 67 65 55 72 6c 3a 20 75 72 6c 28 77 69 64 74 68 3a 20 37 32 30 2c 20 68 65 69 67 68 74 3a 20 32 31 37 29 5c 6e 20 20 20 20 20 20 20 20 20 20 62 69 67 49 6d 61 67 65 55 72 6c 3a 20 75 72 6c 28 77 69 64 74 68 3a 20 32 38 38 30 2c 20 68 65 69 67 68 74 3a 20 38 36 38 29 5c 6e 20 20 20 20 20 20 20 20 20 20 61 6c 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 53 63 68 65 6d 65 5c 6e 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 44 65 73 6b 74 6f 70 48 65 72 6f 53 6f 6c 69 64 42 67 20 7b 5c 6e 20 20 20 20 20 20 20 20 74 69 74 Data Ascii: e\n backgroundImage {\n id\n smallImageUrl: url(width: 720, height: 217)\n bigImageUrl: url(width: 2880, height: 868)\n alt\n }\n colorScheme\n }\n ... on DesktopHeroSolidBg {\n tit
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 74 61 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 43 54 41 46 72 61 67 6d 65 6e 74 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 Data Ascii: [],directives:[]}]}}]}},{kind:"Field",name:{kind:"Name",value:"cta"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"SecondaryBannerCTAFragment"},directives:[]}]}},{kind:"Field",name
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 76 61 6c 75 65 3a 22 61 72 69 61 4c 61 62 65 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 61 72 67 65 74 4c 61 6e 64 69 6e 67 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a Data Ascii: value:"ariaLabel"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"text"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"targetLanding"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:
2024-01-15 23:16:18 UTC	7370	IN	Data Raw: 74 75 72 6e 20 74 7d 7d 29 3b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 49 4e 44 45 58 5f 4d 41 49 4e 5f 44 45 53 4b 54 4f 50 3d 22 39 31 38 61 33 37 38 35 2d 34 34 30 61 2d 34 33 31 65 2d 61 30 36 61 2d 33 66 34 39 62 64 64 65 35 33 33 36 22 2c 65 2e 49 4e 44 45 58 5f 4d 41 49 4e 5f 4d 44 4f 54 3d 22 31 37 66 35 31 31 30 36 2d 61 37 63 32 2d 34 64 33 30 2d 38 66 61 36 2d 63 39 36 62 32 35 66 66 65 63 64 33 22 2c 65 2e 47 4c 4f 42 41 4c 5f 41 4c 45 52 54 53 3d 22 69 6e 64 65 78 5f 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 73 22 2c 65 7d 28 7b 7d 29 7d 2c 22 35 64 62 38 39 32 30 64 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 64 28 6e 2c 7b 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d Data Ascii: turn t}});let t=function(e){return e.INDEX_MAIN_DESKTOP="918a3785-440a-431e-a06a-3f49bdde5336",e.INDEX_MAIN_MDOT="17f51106-a7c2-4d30-8fa6-c96b25ffecd3",e.GLOBAL_ALERTS="index_global_alerts",e}({})},"5db8920d":function(e,n,i){i.d(n,{l:function(){return a}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49836	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	1265	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D
2024-01-15 23:16:18 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:18 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=058ea3a17dd700d6&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvntkQO7Y_xi2CrF5-MUY4kq8DGebjXmZE x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: VRrJKA6xDMy3ue8fh6gw94mIBMXiZS9rdEIteiQ53_aBMwhestKG5w==
2024-01-15 23:16:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49837	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 153072 Connection: close Date: Mon, 15 Jan 2024 16:38:15 GMT Last-Modified: Mon, 15 Jan 2024 16:23:25 GMT ETag: "b784a10f3e0a67de1f039c5da9307d34" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GcfhqSlQxX6laSWvPSw_OLQhf5iCGLDh Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: MiGc7JB9Na-cVgGWx4YzeVpNOjaz_fmQ2dI1RZB8gphZXhBhhUNVKA== Age: 23884 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 64 32 61 37 33 38 64 61 2e 62 30 39 61 65 39 30 65 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 32 61 37 33 38 64 61 22 5d 2c 7b 62 36 65 61 34 66 65 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 Data Ascii: /! For license information please see d2a738da.b09ae90e.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["d2a738da"],{b6ea4fe7:function(e,n,i){"use strict";i.d(
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 39 65 31 31 32 31 39 36 33 22 2c 6b 3d 22 61 31 61 61 63 35 31 66 32 34 22 2c 67 3d 22 63 33 35 35 32 34 36 65 35 36 22 2c 5f 3d 22 65 34 35 36 38 35 31 31 33 38 22 2c 4e 3d 69 28 22 38 31 34 30 63 33 64 31 22 29 2c 53 3d 69 28 22 39 62 33 37 61 31 32 61 22 29 2c 45 3d 69 28 22 66 63 39 35 33 30 64 37 22 29 2c 70 3d 69 28 22 61 35 62 36 65 31 35 32 22 29 3b 63 6f 6e 73 74 20 66 3d 65 3d 3e 7b 6c 65 74 7b 62 61 6e 6e 65 72 49 64 3a 6e 2c 63 61 70 74 69 6f 6e 3a 69 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 74 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 2c 73 75 62 74 69 74 6c 65 3a 64 2c 63 74 61 3a 76 2c 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3a 53 2c 63 6f 6e 74 61 69 6e 65 72 43 6c 61 73 73 4e 61 6d 65 3a 45 2c 63 6f 6c 6f 72 53 63 Data Ascii: 9e1121963",k="a1aac51f24",g="c355246e56",_="e456851138",N=i("8140c3d1"),S=i("9b37a12a"),E=i("fc9530d7"),p=i("a5b6e152");const f=e=>{let{bannerId:n,caption:i,titleFirstLine:t,titleSecondLine:a,subtitle:d,cta:v,backgroundImage:S,containerClassName:E,colorSc
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 65 73 6b 74 6f 70 48 65 72 6f 46 75 6c 6c 49 6d 61 67 65 22 3a 72 65 74 75 72 6e 28 28 65 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 7b 63 61 70 74 69 6f 6e 3a 69 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 74 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 2c 73 75 62 74 69 74 6c 65 3a 72 2c 63 6f 6c 6f 72 53 63 68 65 6d 65 3a 64 2c 63 74 61 3a 6f 2c 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3a 6c 2c 73 69 67 6e 61 74 75 72 65 3a 73 7d 3d 6e 3b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 66 75 6c 6c 2d 69 6d 61 67 65 22 2c 62 61 6e 6e 65 72 49 64 3a 65 2c 63 61 70 74 69 6f 6e 3a 52 28 69 29 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 74 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 7c 7c 76 6f 69 64 20 30 2c 73 75 62 74 69 74 6c 65 3a 72 7c 7c Data Ascii: esktopHeroFullImage":return((e,n)=>{const{caption:i,titleFirstLine:t,titleSecondLine:a,subtitle:r,colorScheme:d,cta:o,backgroundImage:l,signature:s}=n;return{type:"full-image",bannerId:e,caption:R(i),titleFirstLine:t,titleSecondLine:a\|\|void 0,subtitle:r\|\|
2024-01-15 23:16:18 UTC	2703	IN	Data Raw: 7d 2c 7b 6b 69 6e 64 3a 22 41 72 67 75 6d 65 6e 74 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 65 69 67 68 74 22 7d 2c 76 61 6c 75 65 3a 7b 6b 69 6e 64 3a 22 49 6e 74 56 61 6c 75 65 22 2c 76 61 6c 75 65 3a 22 39 30 30 22 7d 7d 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 61 6c 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 6f 6c 6f 72 53 63 68 65 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 Data Ascii: },{kind:"Argument",name:{kind:"Name",value:"height"},value:{kind:"IntValue",value:"900"}}],directives:[]},{kind:"Field",name:{kind:"Name",value:"alt"},arguments:[],directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"colorScheme"},arguments:[],directi
2024-01-15 23:16:18 UTC	13155	IN	Data Raw: 6e 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 44 65 73 6b 74 6f 70 48 65 72 6f 46 75 6c 6c 49 6d 61 67 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 5c 6e 20 20 20 20 20 20 20 20 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 5c 6e 20 20 20 20 20 20 20 20 73 75 62 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 20 20 63 74 61 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 48 65 72 6f 43 54 41 46 72 61 67 6d 65 6e 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 6f 54 65 78 74 43 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 Data Ascii: n ... on DesktopHeroFullImage {\n titleFirstLine\n titleSecondLine\n subtitle\n cta {\n ...HeroCTAFragment\n }\n caption {\n ... on HeroTextCaption {\n text\n }\n
2024-01-15 23:16:18 UTC	12792	IN	Data Raw: 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 43 54 41 46 72 61 67 6d 65 6e 74 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 Data Ascii: ns:[{kind:"FragmentSpread",name:{kind:"Name",value:"SecondaryBannerCTAFragment"},directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"backgroundImage"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"
2024-01-15 23:16:18 UTC	12792	IN	Data Raw: 2c 6f 2e 64 65 66 69 6e 69 74 69 6f 6e 73 2c 73 2e 64 65 66 69 6e 69 74 69 6f 6e 73 2c 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 44 65 66 69 6e 69 74 69 6f 6e 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 47 6c 6f 62 61 6c 41 6c 65 72 74 73 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 22 7d 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 47 6c 6f 62 61 6c 41 6c 65 72 74 73 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 Data Ascii: ,o.definitions,s.definitions,[{kind:"FragmentDefinition",name:{kind:"Name",value:"GlobalAlertsMerchComponents"},typeCondition:{kind:"NamedType",name:{kind:"Name",value:"GlobalAlerts"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Fie
2024-01-15 23:16:18 UTC	12792	IN	Data Raw: 6e 64 69 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 50 61 74 68 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 71 75 65 72 79 50 61 72 61 6d 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e Data Ascii: nding"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"urlPath"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"queryParams"},arguments:[],directives:[],selectionSet:{kind:"Selection
2024-01-15 23:16:18 UTC	12792	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 7b 2e 2e 2e 6d 2c 2e 2e 2e 65 7d 3b 72 65 74 75 72 6e 20 6c 2e 75 73 65 51 75 65 72 79 28 76 2c 6e 29 7d 28 7b 73 6b 69 70 3a 72 2c 63 6f 6e 74 65 78 74 3a 7b 68 65 61 64 65 72 73 3a 7b 2e 2e 2e 28 30 2c 5f 2e 6c 29 28 21 30 29 7d 7d 7d 29 3b 72 65 74 75 72 6e 28 30 2c 67 2e 7a 29 28 22 52 65 73 70 6f 6e 73 65 20 66 6f 72 20 77 63 75 20 63 6f 6e 74 65 78 74 20 71 75 65 72 79 20 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 65 72 72 6f 72 3a 64 2c 6c 6f 61 64 69 6e 67 3a 73 2c 64 61 74 61 3a 63 7d 29 29 2c 61 26 26 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 52 65 73 70 6f 6e 73 65 20 66 6f 72 20 77 63 75 20 63 6f 6e 74 65 78 74 20 71 75 65 72 79 20 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 Data Ascii: nction(e){const n={...m,...e};return l.useQuery(v,n)}({skip:r,context:{headers:{...(0,_.l)(!0)}}});return(0,g.z)("Response for wcu context query ",JSON.stringify({error:d,loading:s,data:c})),a&&console.log("Response for wcu context query ",JSON.stringify(
2024-01-15 23:16:18 UTC	6396	IN	Data Raw: 74 22 2c 5a 3d 22 67 65 6e 69 75 73 20 6c 65 76 65 6c 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 4a 3d 22 75 73 65 72 20 6c 6f 67 67 65 64 20 69 6e 20 64 61 74 61 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 51 3d 22 75 73 65 72 20 63 6f 75 6e 74 72 79 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 65 65 3d 22 64 65 73 74 20 63 6f 75 6e 74 72 79 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 6e 65 3d 22 64 65 73 74 69 6e 61 74 69 6f 6e 20 6e 61 6d 65 20 69 73 20 Data Ascii: t",Z="genius level is not found in window.booking object",J="user logged in data is not found in window.booking object",Q="user country is not found in window.booking object",ee="dest country is not found in window.booking object",ne="destination name is

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49839	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 83082 Connection: close Date: Mon, 15 Jan 2024 16:38:15 GMT Last-Modified: Mon, 15 Jan 2024 16:23:25 GMT ETag: "90af4f7d03acdf40d8242f30e2fb0a85" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eNb6WNMzTplU2ySq4MjrHGlImCLQ0xwr Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: j1vxnjghEsyu3niDQZneVRInjBEOxehf_nM0hNTxpNc-pZb_FKNWUA== Age: 23884 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 31 62 61 66 35 61 36 33 2e 62 64 61 31 61 34 37 63 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 62 61 66 35 61 36 33 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 1baf5a63.bda1a47c.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["1baf5a63"],{bca1141e:function(e,t,n){"use strict";var
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 2e 37 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 39 2e 35 7a 6d 33 2d 31 2e 35 68 33 2e 35 41 2e 32 35 2e 32 35 20 30 20 30 20 31 20 39 20 32 2e 37 35 76 32 2e 35 6c 2e 37 35 2d 2e 37 35 68 2d 34 2e 35 6c 2e 37 35 2e 37 35 76 2d 32 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2e 32 35 7a 6d 30 2d 31 2e 35 63 2d 2e 36 39 20 30 2d 31 2e 32 35 2e 35 36 2d 31 2e 32 35 20 31 2e 32 35 76 32 2e 35 63 30 20 2e 34 31 34 2e 33 33 36 2e 37 35 2e 37 35 2e 37 35 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 76 2d 32 2e 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 33 2e 35 7a 4d 35 2e 32 35 20 39 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 Data Ascii: .75c0-.69-.56-1.25-1.25-1.25h-9.5zm3-1.5h3.5A.25.25 0 0 1 9 2.75v2.5l.75-.75h-4.5l.75.75v-2.5a.25.25 0 0 1-.25.25zm0-1.5c-.69 0-1.25.56-1.25 1.25v2.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 .75-.75v-2.5c0-.69-.56-1.25-1.25-1.25h-3.5zM5.25 9h4.5a.75.75 0 0 0
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 45 56 3d 22 42 49 5a 44 45 56 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 45 41 44 3d 22 43 48 41 4e 4e 45 4c 5f 44 45 41 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 3d 22 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 22 2c 65 2e 43 4f 52 50 54 52 41 56 45 4c 3d 22 43 4f 52 50 54 52 41 56 45 4c 22 2c 65 2e 4c 4f 4e 47 54 41 49 4c 3d 22 4c Data Ascii: EV="BIZDEV",e.CHANNEL_DEAD="CHANNEL_DEAD",e.CHANNEL_DIRECT="CHANNEL_DIRECT",e.CHANNEL_PAID="CHANNEL_PAID",e.CHANNEL_PAID_BRAND="CHANNEL_PAID_BRAND",e.CHANNEL_SEO="CHANNEL_SEO",e.CHANNEL_SEO_BRAND="CHANNEL_SEO_BRAND",e.CORPTRAVEL="CORPTRAVEL",e.LONGTAIL="L
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 69 74 79 5d 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 7c 7c 22 22 29 28 65 29 3b 63 61 73 65 20 4c 2e 4e 72 3a 72 65 74 75 72 6e 28 65 3d 3e 5b 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 69 74 79 2c 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 6f 75 6e 74 72 79 5d 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 7c 7c 22 22 29 28 65 29 3b 63 61 73 65 20 67 2e 69 24 3a 72 65 74 75 72 6e 28 65 3d 3e 5b 65 2e 64 69 73 74 72 69 63 74 4e 61 6d 65 2c 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c Data Ascii: e.basicPropertyData.location.city].filter(Boolean).join(", ")\|\|"")(e);case L.Nr:return(e=>[e.basicPropertyData.location.city,e.basicPropertyData.location.country].filter(Boolean).join(", ")\|\|"")(e);case g.i$:return(e=>[e.districtName,e.basicPropertyData.l
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 74 72 75 63 74 55 72 6c 29 28 7b 70 61 74 68 6e 61 6d 65 3a 60 2f 73 65 61 72 63 68 72 65 73 75 6c 74 73 24 7b 22 65 6e 2d 75 73 22 3d 3d 3d 43 3f 22 22 3a 22 2e 22 2b 43 7d 2e 68 74 6d 6c 60 7d 29 2c 44 3d 4c 2e 73 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 41 26 26 49 26 26 28 44 2e 73 65 74 28 22 63 68 65 63 6b 69 6e 22 2c 41 29 2c 44 2e 73 65 74 28 22 63 68 65 63 6b 6f 75 74 22 2c 49 29 29 2c 64 26 26 75 26 26 28 44 2e 73 65 74 28 22 64 65 73 74 5f 69 64 22 2c 53 74 72 69 6e 67 28 64 29 29 2c 44 2e 73 65 74 28 22 64 65 73 74 5f 74 79 70 65 22 2c 53 74 72 69 6e 67 28 75 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 45 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f Data Ascii: tructUrl)({pathname:`/searchresults${"en-us"===C?"":"."+C}.html`}),D=L.searchParams;if(A&&I&&(D.set("checkin",A),D.set("checkout",I)),d&&u&&(D.set("dest_id",String(d)),D.set("dest_type",String(u).toLowerCase())),"undefined"!==typeof E&&"undefined"!==typeo
2024-01-15 23:16:18 UTC	1162	IN	Data Raw: 2e 24 79 3d 65 2e 67 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 29 2c 74 68 69 73 2e 24 4d 3d 65 2e 67 65 74 55 54 43 4d 6f 6e 74 68 28 29 2c 74 68 69 73 2e 24 44 3d 65 2e 67 65 74 55 54 43 44 61 74 65 28 29 2c 74 68 69 73 2e 24 57 3d 65 2e 67 65 74 55 54 43 44 61 79 28 29 2c 74 68 69 73 2e 24 48 3d 65 2e 67 65 74 55 54 43 48 6f 75 72 73 28 29 2c 74 68 69 73 2e 24 6d 3d 65 2e 67 65 74 55 54 43 4d 69 6e 75 74 65 73 28 29 2c 74 68 69 73 2e 24 73 3d 65 2e 67 65 74 55 54 43 53 65 63 6f 6e 64 73 28 29 2c 74 68 69 73 2e 24 6d 73 3d 65 2e 67 65 74 55 54 43 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 28 29 7d 65 6c 73 65 20 6f 2e 63 61 6c 6c 28 74 68 69 73 29 7d 3b 76 61 72 20 73 3d 69 2e 75 74 63 4f 66 66 73 65 74 3b 69 2e 75 74 63 4f 66 66 73 65 74 3d 66 75 6e 63 74 69 Data Ascii: .$y=e.getUTCFullYear(),this.$M=e.getUTCMonth(),this.$D=e.getUTCDate(),this.$W=e.getUTCDay(),this.$H=e.getUTCHours(),this.$m=e.getUTCMinutes(),this.$s=e.getUTCSeconds(),this.$ms=e.getUTCMilliseconds()}else o.call(this)};var s=i.utcOffset;i.utcOffset=functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49840	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/4e596c2c.b4b42785.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:18 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 868846 Connection: close Last-Modified: Fri, 12 Jan 2024 16:20:07 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: wl68LDEoUnNBJfWu.WWbEfb2Vf00HjGl Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:38:16 GMT ETag: "208e83aab1a66b2df03e2388ea2f9e19" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 0z0AF8Tja3YvzyVd68ngwgu2U0umQvH9XtjCaRctJJ76TcchMckfPA== Age: 23883 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 65 35 39 36 63 32 63 22 2c 22 36 34 63 61 33 36 36 39 22 2c 22 62 38 63 63 34 35 32 64 22 2c 22 35 65 61 63 66 35 30 64 22 2c 22 63 35 38 64 39 34 35 35 22 5d 2c 7b 22 35 31 61 33 38 38 63 33 22 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 74 29 7b 76 61 72 20 6e 3d 74 28 22 36 65 38 62 34 30 37 32 22 29 3b 65 2e 5a 3d 6e 2e 5a 7d 2c 22 34 34 66 30 61 36 66 38 22 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4e596c2c","64ca3669","b8cc452d","5eacf50d","c58d9455"],{"51a388c3":function(a,e,t){var n=t("6e8b4072");e.Z=n.Z},"44f0a6f8"
2024-01-15 23:16:18 UTC	16384	IN	Data Raw: 34 2d 36 2e 30 33 35 38 2d 31 2e 39 30 37 39 31 37 38 2d 39 2e 32 30 31 2d 31 2e 38 37 38 39 39 39 31 2d 33 2e 31 34 36 39 36 2d 2e 30 33 2d 36 2e 32 37 37 39 36 2e 36 31 30 30 30 30 31 2d 39 2e 31 37 34 39 36 20 31 2e 38 37 33 39 39 39 31 2d 2e 33 39 34 37 36 2e 31 37 38 32 38 2d 2e 37 32 39 33 37 2e 34 36 37 31 39 2d 2e 39 36 33 32 39 2e 38 33 31 37 35 2d 2e 32 33 33 39 33 2e 33 36 34 35 35 2d 2e 33 35 37 31 34 2e 37 38 39 31 31 2d 2e 33 35 34 37 31 20 31 2e 32 32 32 32 35 7a 6d 31 2e 35 2d 2e 30 30 35 63 2d 2e 30 30 31 30 39 2d 2e 31 34 32 2e 30 33 38 39 33 2d 2e 32 38 31 32 39 2e 31 31 35 32 33 2d 2e 34 30 31 30 35 2e 30 37 36 33 2d 2e 31 31 39 37 37 2e 31 38 35 36 31 2d 2e 32 31 34 39 31 2e 33 31 34 37 37 2d 2e 32 37 33 39 35 20 32 2e 36 39 39 39 36 Data Ascii: 4-6.0358-1.9079178-9.201-1.8789991-3.14696-.03-6.27796.6100001-9.17496 1.8739991-.39476.17828-.72937.46719-.96329.83175-.23393.36455-.35714.78911-.35471 1.22225zm1.5-.005c-.00109-.142.03893-.28129.11523-.40105.0763-.11977.18561-.21491.31477-.27395 2.69996
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 2c 22 64 61 74 61 2d 72 74 6c 2d 66 6c 69 70 22 3a 22 74 72 75 65 22 7d 2c 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 34 2e 35 20 32 2e 39 39 38 61 31 2e 35 20 31 2e 35 20 30 20 31 20 31 2d 33 20 30 20 31 2e 35 20 31 2e 35 20 30 20 30 20 31 20 33 20 30 7a 6d 31 2e 35 20 30 61 33 20 33 20 30 20 31 20 30 2d 36 20 30 20 33 20 33 20 30 20 30 20 30 20 36 20 30 7a 6d 2d 31 2e 35 20 39 61 31 2e 35 20 31 2e 35 20 30 20 31 20 31 2d 33 20 30 20 31 2e 35 20 31 2e 35 20 30 20 30 20 31 20 33 20 30 7a 6d 31 2e 35 20 30 61 33 20 33 20 30 20 31 20 30 2d 36 20 30 20 33 20 33 20 30 20 30 20 30 20 36 20 30 7a 6d 2d 31 Data Ascii: ww.w3.org/2000/svg",viewBox:"0 0 24 24","data-rtl-flip":"true"},n.createElement("path",{d:"M4.5 2.998a1.5 1.5 0 1 1-3 0 1.5 1.5 0 0 1 3 0zm1.5 0a3 3 0 1 0-6 0 3 3 0 0 0 6 0zm-1.5 9a1.5 1.5 0 1 1-3 0 1.5 1.5 0 0 1 3 0zm1.5 0a3 3 0 1 0-6 0 3 3 0 0 0 6 0zm-1
2024-01-15 23:16:19 UTC	14808	IN	Data Raw: 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 33 2e 37 34 34 20 31 39 2e 35 68 31 36 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 2d 31 2e 35 68 2d 31 36 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 7a 4d 31 39 2e 34 39 37 20 31 32 76 39 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 2d 2e 37 35 2e 37 35 68 2d 31 33 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 2d 2e 37 35 2d 2e 37 35 56 32 2e 32 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2d 2e 37 35 68 31 33 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2e 37 35 56 31 32 7a 6d 31 2e 35 20 30 56 32 2e 32 35 41 32 2e 32 35 20 32 2e 32 35 20 30 20 30 20 30 20 31 38 2e 37 34 37 Data Ascii: ox:"0 0 24 24"},n.createElement("path",{d:"M3.744 19.5h16.5a.75.75 0 0 0 0-1.5h-16.5a.75.75 0 0 0 0 1.5zM19.497 12v9.75a.75.75 0 0 1-.75.75h-13.5a.75.75 0 0 1-.75-.75V2.25a.75.75 0 0 1 .75-.75h13.5a.75.75 0 0 1 .75.75V12zm1.5 0V2.25A2.25 2.25 0 0 0 18.747
2024-01-15 23:16:19 UTC	1576	IN	Data Raw: 29 2c 68 3d 74 28 22 39 66 34 33 38 30 34 62 22 29 2c 7a 3d 74 28 22 39 37 35 66 34 62 38 35 22 29 2c 77 3d 74 28 22 36 33 35 36 63 34 61 38 22 29 2c 75 3d 74 28 22 36 32 32 39 64 38 39 38 22 29 2c 69 3d 74 28 22 61 62 61 62 31 61 66 65 22 29 3b 76 61 72 20 73 3d 61 3d 3e 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 72 2e 75 73 65 49 31 38 6e 29 28 29 3b 72 65 74 75 72 6e 28 30 2c 63 2e 75 73 65 4d 65 6d 6f 29 28 28 28 29 3d 3e 7b 6c 65 74 20 74 2c 6e 3b 72 65 74 75 72 6e 20 61 3c 33 3f 28 74 3d 65 2e 74 72 61 6e 73 28 28 30 2c 69 2e 74 29 28 22 61 31 31 79 5f 61 64 6a 65 63 74 69 76 65 5f 72 61 74 69 6e 67 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 72 61 74 69 6e 67 5f 61 64 6a 65 63 74 69 76 65 3a 22 31 22 7d 7d 29 29 2c 6e 3d 65 2e 74 72 61 6e 73 28 28 30 2c 69 Data Ascii: ),h=t("9f43804b"),z=t("975f4b85"),w=t("6356c4a8"),u=t("6229d898"),i=t("abab1afe");var s=a=>{const e=(0,r.useI18n)();return(0,c.useMemo)((()=>{let t,n;return a<3?(t=e.trans((0,i.t)("a11y_adjective_rating",{variables:{rating_adjective:"1"}})),n=e.trans((0,i
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 65 2e 74 72 61 6e 73 28 28 30 2c 69 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 65 78 63 65 70 74 69 6f 6e 61 6c 22 29 29 29 2c 7b 61 31 31 79 52 61 74 69 6e 67 41 64 6a 65 63 74 69 76 65 3a 74 2c 72 61 74 69 6e 67 41 64 6a 65 63 74 69 76 65 3a 6e 7d 7d 29 2c 5b 65 2c 61 5d 29 7d 3b 76 61 72 20 67 3d 61 3d 3e 7b 6c 65 74 7b 74 69 74 6c 65 3a 65 2c 73 75 62 54 69 74 6c 65 3a 74 2c 73 75 62 54 69 74 6c 65 32 3a 69 2c 70 72 69 63 65 54 65 78 74 3a 67 2c 75 72 6c 3a 66 2c 69 6d 67 3a 4d 2c 66 6f 72 6d 61 74 74 65 64 50 72 69 63 65 3a 70 2c 72 65 76 69 65 77 53 63 6f 72 65 3a 41 2c 73 69 7a 65 3a 64 2c 69 64 3a 45 2c 69 74 65 6d 49 6e 64 65 78 3a 78 2c 61 73 70 65 63 74 52 61 74 69 6f 3a 48 2c 6f 6e 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3a 56 2c 6f 6e 56 69 Data Ascii: e.trans((0,i.t)("review_adj_exceptional"))),{a11yRatingAdjective:t,ratingAdjective:n}}),[e,a])};var g=a=>{let{title:e,subTitle:t,subTitle2:i,priceText:g,url:f,img:M,formattedPrice:p,reviewScore:A,size:d,id:E,itemIndex:x,aspectRatio:H,onClickHandler:V,onVi
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 72 6e 20 24 6c 2e 5a 7d 2c 48 6f 75 72 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 72 7d 2c 48 6f 75 72 67 6c 61 73 73 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 72 7d 2c 48 6f 75 73 65 41 70 61 72 74 6d 65 6e 74 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 72 7d 2c 48 6f 75 73 65 43 68 69 6d 6e 65 79 41 6c 74 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 72 7d 2c 48 6f 75 73 65 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 72 7d 2c 48 6f 75 73 65 4d 6f 64 65 72 6e 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 72 7d 2c 48 6f 75 73 65 4e 61 74 75 72 65 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: rn $l.Z},HourIcon:function(){return er},HourglassIcon:function(){return tr},HouseApartmentIcon:function(){return lr},HouseChimneyAltIcon:function(){return cr},HouseIcon:function(){return nr},HouseModernIcon:function(){return rr},HouseNatureIcon:function()
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 65 61 74 68 65 72 4d 6f 6f 6e 53 74 61 72 73 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7a 7d 2c 57 65 61 74 68 65 72 50 61 72 74 6c 79 43 6c 6f 75 64 79 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7a 7d 2c 57 65 61 74 68 65 72 50 61 72 74 6c 79 53 6e 6f 77 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 7a 7d 2c 57 65 61 74 68 65 72 52 61 69 6e 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7a 7d 2c 57 65 61 74 68 65 72 52 61 69 6e 54 68 75 6e 64 65 72 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7a 7d 2c 57 65 61 74 68 65 72 53 6c 65 65 74 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7a 7d 2c 57 Data Ascii: eatherMoonStarsIcon:function(){return uz},WeatherPartlyCloudyIcon:function(){return iz},WeatherPartlySnowIcon:function(){return Mz},WeatherRainIcon:function(){return sz},WeatherRainThunderIcon:function(){return bz},WeatherSleetIcon:function(){return Az},W
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 37 2e 32 35 76 32 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2d 2e 32 35 48 35 2e 37 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2e 32 35 76 2d 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2e 32 35 68 31 32 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2d 2e 32 35 76 32 2e 35 7a 6d 31 2e 35 20 30 76 2d 32 2e 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 48 35 2e 37 35 63 2d 2e 36 39 20 30 2d 31 2e 32 35 2e 35 36 2d 31 2e 32 35 20 31 2e 32 35 76 35 63 30 20 2e 36 39 2e 35 36 20 31 2e 32 35 20 31 2e 32 35 20 31 2e 32 35 68 31 32 2e 35 63 2e 36 39 20 30 20 31 2e 32 35 2d 2e 35 36 20 31 2e 32 35 2d 31 2e 32 35 76 2d 32 2e 35 7a 4d 35 2e 32 35 20 31 38 68 31 33 2e 35 61 2e 37 35 2e 37 Data Ascii: 7.25v2.5a.25.25 0 0 1 .25-.25H5.75a.25.25 0 0 1 .25.25v-5a.25.25 0 0 1-.25.25h12.5a.25.25 0 0 1-.25-.25v2.5zm1.5 0v-2.5c0-.69-.56-1.25-1.25-1.25H5.75c-.69 0-1.25.56-1.25 1.25v5c0 .69.56 1.25 1.25 1.25h12.5c.69 0 1.25-.56 1.25-1.25v-2.5zM5.25 18h13.5a.75.7
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 30 2e 35 20 31 30 2e 35 61 2e 37 35 2e 37 35 20 30 20 31 20 30 20 31 2e 30 36 2d 31 2e 30 36 7a 22 7d 29 29 7d 3b 76 61 72 20 41 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 32 33 2e 34 32 31 20 31 31 2e 37 36 35 4c 31 33 2e 37 36 38 2e 38 41 32 2e 36 34 31 20 32 2e 36 34 31 20 30 20 30 20 30 20 31 32 20 30 61 32 2e 36 34 35 20 32 2e 36 34 35 20 30 20 30 20 30 2d 31 2e 37 36 38 2e 38 4c 2e 35 37 39 20 31 31 2e 37 36 35 41 31 Data Ascii: 0.5 10.5a.75.75 0 1 0 1.06-1.06z"}))};var Aa=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M23.421 11.765L13.768.8A2.641 2.641 0 0 0 12 0a2.645 2.645 0 0 0-1.768.8L.579 11.765A1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49842	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	637	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:18 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d3626cbe209f-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 33314 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:16:18 GMT Last-Modified: Fri, 17 Nov 2023 13:58:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: CoP2FogSq6tLD5K02GDrqw== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1bbb3d5c-701e-008c-395e-19518d000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:16:19 UTC	467	IN	Data Raw: 37 63 31 62 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c1b{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 Data Ascii: kiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysAct
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 70 72 65 66 65 72 65 6e 63 65 73 22 2c Data Ascii: ition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage cookie preferences",
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 Data Ascii: e technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selected currency, langua
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 22 3a 22 50 61 74 74 65 72 6e 7c 5f 64 63 5f 67 74 6d 5f 55 41 2d 22 2c 22 69 64 22 3a 22 63 31 36 31 63 63 63 65 2d 34 65 62 34 2d 34 61 31 32 2d 61 33 62 65 2d 36 34 36 32 32 36 66 30 39 65 39 30 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f 61 64 20 6f 74 68 65 72 20 73 63 72 69 70 74 73 20 61 6e 64 20 63 6f 64 Data Ascii: ":"Pattern\|_dc_gtm_UA-","id":"c161ccce-4eb4-4a12-a3be-646226f09e90","Name":"_dc_gtm_UA-xxxxxxxx","Host":"booking.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to load other scripts and cod
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 67 61 74 69 6f 6e 20 73 6f 6c 75 74 69 6f 6e 2c 20 74 6f 20 66 6c 61 67 20 66 65 61 74 75 72 65 73 20 66 6f 72 20 62 72 6f 77 73 65 72 20 64 65 74 65 63 74 69 6f 6e 20 61 6e 64 20 64 69 73 74 69 6e 67 75 69 73 68 69 6e 67 20 77 68 65 74 68 65 72 20 69 74 20 69 73 20 61 20 72 65 61 6c 20 75 73 65 72 20 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 62 6f 74 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 30 65 61 38 61 34 30 33 2d 33 32 64 64 2d 34 35 32 64 2d 62 35 65 62 2d 37 30 64 33 31 36 61 33 31 61 36 66 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 63 63 63 22 2c 22 48 6f 73 74 22 3a 22 63 66 2e 62 73 74 Data Ascii: gation solution, to flag features for browser detection and distinguishing whether it is a real user or malicious bot.","patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"0ea8a403-32dd-452d-b5eb-70d316a31a6f","Name":"_pxff_ccc","Host":"cf.bst
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 35 65 32 35 66 65 63 32 2d 37 30 38 30 2d 34 32 61 30 2d 39 35 34 36 2d 66 39 63 36 30 35 65 64 32 36 39 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 66 70 22 2c 22 48 6f 73 74 22 3a 22 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 Data Ascii: n":"Dropped by Security team as part of PerimeterX security services.","patternKey":null,"thirdPartyKey":"","firstPartyKey":"","id":"5e25fec2-7080-42a0-9546-f9c605ed269c","Name":"_pxff_fp","Host":"account.booking.com","IsSession":false,"Length":"0","descr
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4f 77 6e 65 64 20 62 79 20 6f 75 72 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 2e 20 55 73 65 64 20 66 6f 72 20 62 6f 74 20 64 65 74 65 63 74 69 6f 6e 20 76 69 61 20 61 6e 20 65 78 74 65 72 6e 61 6c 20 73 6f 75 72 63 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 2f 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 Data Ascii: :false,"Length":"365","description":"Owned by our Security team. Used for bot detection via an external source: https://www.perimeterx.com/","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"Dropped by Security team as part
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 75 73 65 64 20 74 6f 20 61 74 74 72 69 62 75 74 65 20 62 6f 6f 6b 69 6e 67 73 20 74 6f 20 74 68 65 20 63 6f 72 72 65 63 74 20 70 61 72 74 6e 65 72 20 6f 72 20 62 75 73 69 6e 65 73 73 20 65 6e 74 69 74 79 20 61 6e 64 20 69 73 20 66 75 6e 64 61 6d 65 6e 74 61 6c 20 74 6f 20 6f 75 72 20 77 68 69 74 65 20 6c 61 62 65 6c 20 62 75 73 69 6e 65 73 73 20 6d 6f 64 65 6c 2e 20 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 Data Ascii: .com","IsSession":true,"Length":"0","description":"This cookie is used to attribute bookings to the correct partner or business entity and is fundamental to our white label business model. ","DurationType":1,"category":null,"isThirdParty":false},{"thirdPa
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 66 32 61 61 61 22 2c 22 4e 61 6d 65 22 3a 22 62 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 52 65 6d 65 6d 62 65 72 73 20 69 66 20 74 68 65 20 75 73 65 72 20 68 61 73 20 62 65 65 6e 20 61 73 6b 65 64 20 61 20 6d 61 78 2e 20 6f 66 20 74 68 72 65 65 20 74 69 6d 65 73 20 61 62 6f 75 74 20 68 69 73 2f 68 65 72 20 6c 61 6e 67 75 61 67 65 20 73 65 74 74 69 6e 67 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f Data Ascii: f2aaa","Name":"b","Host":"booking.com","IsSession":false,"Length":"30","description":"Remembers if the user has been asked a max. of three times about his/her language setting.","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescriptio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49844	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:18 UTC	589	OUT	GET /psb/capla/static/js/21928fd5.17ce1306.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 171176 Connection: close Last-Modified: Fri, 12 Jan 2024 16:20:07 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: bgj8iWEjo7ZUsYLZTRycbu_kKMqUsEOo Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 18:20:01 GMT ETag: "dc8762d4c9a1a3d1025832e3b9bdd7d2" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: nAetLuOgOrTti5jptlFeC4RJEctcHlgytFkzSdc8oht2VovkYxBZAQ== Age: 17779 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 32 31 39 32 38 66 64 35 2e 31 37 63 65 31 33 30 36 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 31 39 32 38 66 64 35 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 21928fd5.17ce1306.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["21928fd5"],{bca1141e:function(e,n,i){"use strict";var
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 72 20 74 3d 69 28 22 65 61 64 37 31 65 62 30 22 29 3b 6e 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 32 2e 37 35 20 36 68 39 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2d 2e 32 35 76 31 37 2e 35 6c 2e 37 35 2d 2e 37 35 48 32 2e 32 35 6c 2e 37 35 2e 37 35 56 35 2e 37 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2e 32 35 7a 6d 30 2d 31 2e 35 63 2d 2e 36 39 20 30 2d 31 2e 32 35 2e 35 36 2d 31 2e 32 35 Data Ascii: r t=i("ead71eb0");n.Z=function(){return t.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},t.createElement("path",{d:"M2.75 6h9.5a.25.25 0 0 1-.25-.25v17.5l.75-.75H2.25l.75.75V5.75a.25.25 0 0 1-.25.25zm0-1.5c-.69 0-1.25.56-1.25
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 74 69 6e 67 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 72 61 74 69 6e 67 5f 61 64 6a 65 63 74 69 76 65 3a 22 35 22 7d 7d 29 29 2c 74 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 61 62 6f 76 65 5f 61 76 65 72 61 67 65 22 29 29 29 3a 65 3e 3d 36 26 26 65 3c 37 3f 28 69 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 61 31 31 79 5f 61 64 6a 65 63 74 69 76 65 5f 72 61 74 69 6e 67 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 72 61 74 69 6e 67 5f 61 64 6a 65 63 74 69 76 65 3a 22 36 22 7d 7d 29 29 2c 74 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 70 6c 65 61 73 61 6e 74 22 29 29 29 3a 65 3e 3d 37 26 26 65 3c 38 3f 28 69 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 61 Data Ascii: ting",{variables:{rating_adjective:"5"}})),t=n.trans((0,v.t)("review_adj_above_average"))):e>=6&&e<7?(i=n.trans((0,v.t)("a11y_adjective_rating",{variables:{rating_adjective:"6"}})),t=n.trans((0,v.t)("review_adj_pleasant"))):e>=7&&e<8?(i=n.trans((0,v.t)("a
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 30 2c 6f 2e 74 72 61 63 6b 47 6f 61 6c 29 28 22 77 77 77 5f 6e 65 61 72 62 79 5f 64 65 73 74 69 6e 61 74 69 6f 6e 5f 63 6c 69 63 6b 22 29 7d 2c 6f 6e 43 61 72 6f 75 73 65 6c 56 69 65 77 3a 28 29 3d 3e 7b 28 30 2c 6f 2e 74 72 61 63 6b 45 78 70 65 72 69 6d 65 6e 74 53 74 61 67 65 29 28 6f 2e 65 78 70 60 63 43 48 4f 62 45 66 45 49 54 4e 50 66 62 65 51 4d 49 61 57 59 55 51 4a 46 46 51 63 63 43 63 43 63 43 43 60 2c 32 29 7d 7d 3b 76 61 72 20 46 3d 7b 70 72 6f 64 3a 43 2c 64 71 73 3a 7b 2e 2e 2e 43 7d 7d 3b 63 6f 6e 73 74 20 49 3d 7b 63 61 6d 70 61 69 67 6e 49 64 3a 22 34 39 62 34 32 34 63 32 2d 34 63 34 38 2d 34 37 65 30 2d 62 66 34 34 2d 32 34 32 31 36 38 37 32 31 63 36 31 22 2c 63 61 6d 70 61 69 67 6e 4e 61 6d 65 3a 63 2e 5f 2e 46 6c 69 67 68 74 73 43 72 6f Data Ascii: 0,o.trackGoal)("www_nearby_destination_click")},onCarouselView:()=>{(0,o.trackExperimentStage)(o.exp`cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC`,2)}};var F={prod:C,dqs:{...C}};const I={campaignId:"49b424c2-4c48-47e0-bf44-242168721c61",campaignName:c._.FlightsCro
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 49 74 65 6d 52 65 76 69 65 77 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 63 6f 72 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 72 61 74 69 6e 67 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b Data Ascii: :"Name",value:"MerchCarouselItemReview"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"score"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"rating"},arguments:[],directives:[]},{k
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 72 65 67 75 6c 61 72 50 72 69 63 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 50 72 69 63 65 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 74 72 69 6b Data Ascii: lections:[{kind:"Field",name:{kind:"Name",value:"regularPrice"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"Price"},directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"strik
2024-01-15 23:16:19 UTC	14808	IN	Data Raw: 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 48 65 72 6f 42 61 6e 6e 65 72 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 65 72 6f 43 61 6d 70 61 69 67 6e 49 64 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 64 65 73 69 67 6e 56 61 72 69 61 Data Ascii: ion:{kind:"NamedType",name:{kind:"Name",value:"HeroBanner"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"heroCampaignId"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"designVaria
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 20 20 20 74 65 78 74 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 6f 43 6f 75 6e 74 64 6f 77 6e 43 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6d 70 61 69 67 6e 45 6e 64 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 73 69 67 6e 61 74 75 72 65 5c 6e 20 20 20 20 20 20 20 20 69 6c 6c 75 73 74 72 61 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 69 64 5c 6e 20 20 20 20 20 20 20 20 20 20 75 72 6c 3a 20 75 72 6c 28 77 69 64 74 68 3a 20 33 30 30 2c 20 68 65 69 67 68 74 3a 20 33 30 30 29 5c 6e 20 20 20 20 20 20 20 20 20 20 61 6c 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 53 63 Data Ascii: text\n }\n ... on HeroCountdownCaption {\n campaignEnd\n }\n }\n signature\n illustration {\n id\n url: url(width: 300, height: 300)\n alt\n }\n colorSc
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 69 67 6e 61 74 75 72 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 6f 6c 6f 72 53 63 68 65 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 4d 64 6f 74 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 4c 65 67 61 63 79 22 Data Ascii: name:{kind:"Name",value:"signature"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"colorScheme"},arguments:[],directives:[]}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"MdotSecondaryBannerLegacy"
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 72 43 68 69 6c 64 72 65 6e 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 68 69 6c 64 72 65 6e 41 67 65 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 72 52 6f 6f 6d 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 Data Ascii: rguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"nrChildren"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"childrenAges"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"nrRooms"},arguments:[],dire

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49846	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	589	OUT	GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 528195 Connection: close Last-Modified: Fri, 12 Jan 2024 09:30:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 8fHsyNxOTixWNLqS0p5QX5MbPJsCcsDz Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 10:30:28 GMT ETag: "a49908dd31f3e4bd429d8384882c9cd8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: A5kULS8ExZoGBUNxR9PVl11VMYcmDzficHnr6uuqGTe2y4MnydM5aQ== Age: 45952 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 38 32 30 37 63 33 30 33 2e 62 64 63 65 61 62 63 32 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 38 32 30 37 63 33 30 33 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 Data Ascii: /! For license information please see 8207c303.bdceabc2.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["8207c303"],{d0989236:function(e,n,t){"use strict";t.d(
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 61 74 61 2d 74 65 73 74 69 64 22 3a 22 64 61 74 65 70 69 63 6b 65 72 2d 6f 76 65 72 6c 61 79 2d 66 6f 6f 74 65 72 22 7d 7d 29 7d 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 45 2c 7b 69 74 65 6d 73 3a 77 2c 69 73 4f 76 65 72 6c 61 79 3a 21 30 2c 6f 6e 54 61 62 43 68 61 6e 67 65 3a 49 2c 61 63 74 69 76 65 54 61 62 49 64 3a 74 7d 29 29 3a 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 63 6f 6e 74 61 69 6e 65 72 2c 72 65 66 3a 78 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 73 65 61 72 63 68 62 6f 78 2d 64 61 74 65 70 69 63 6b 65 72 22 7d 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 28 29 28 5f 26 26 67 2e 61 62 73 Data Ascii: ata-testid":"datepicker-overlay-footer"}})},r().createElement(E,{items:w,isOverlay:!0,onTabChange:I,activeTabId:t})):r().createElement("div",{className:g.container,ref:x,"data-testid":"searchbox-datepicker"},r().createElement("div",{className:s()(_&&g.abs
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 32 2e 36 36 36 20 34 2e 34 39 61 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 34 31 35 2e 36 37 31 76 32 2e 32 35 61 31 2e 35 20 31 2e 35 20 30 20 30 20 30 20 31 2e 35 20 31 2e 35 68 31 36 2e 35 61 31 2e 35 20 31 2e 35 20 30 20 30 20 30 20 31 2e 35 2d 31 2e 35 76 2d 32 2e 32 35 7a 4d 33 20 35 2e 39 31 31 68 31 38 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 2d 31 2e 35 48 33 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 7a 22 7d 29 29 7d 7d 2c 22 31 65 34 34 63 34 66 32 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3d 74 28 22 65 61 64 37 31 65 62 30 22 29 3b 6e 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 Data Ascii: 2.666 4.49a.75.75 0 0 0-.415.671v2.25a1.5 1.5 0 0 0 1.5 1.5h16.5a1.5 1.5 0 0 0 1.5-1.5v-2.25zM3 5.911h18a.75.75 0 0 0 0-1.5H3a.75.75 0 0 0 0 1.5z"}))}},"1e44c4f2":function(e,n,t){"use strict";var i=t("ead71eb0");n.Z=function(){return i.createElement("svg"
2024-01-15 23:16:19 UTC	15858	IN	Data Raw: 6e 6e 65 72 48 54 4d 4c 3a 7b 5f 5f 68 74 6d 6c 3a 72 2e 74 69 74 6c 65 7d 7d 2c 63 6c 61 73 73 4e 61 6d 65 3a 4e 2e 77 69 74 68 54 65 78 74 4f 76 65 72 66 6c 6f 77 7d 29 2c 79 29 29 7d 7d 2c 22 38 39 34 35 62 63 61 37 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 6e 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 69 3d 74 28 22 65 61 64 37 31 65 62 30 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 6e 29 7b 63 6f 6e 73 74 20 74 3d 28 30 2c 69 2e 75 73 65 52 65 66 29 28 29 3b 72 65 74 75 72 6e 20 6e 2e 73 65 74 53 74 61 72 74 44 61 74 65 4f 6e 4f 70 65 6e 3f 28 74 2e 63 75 72 72 65 6e 74 7c 7c 22 73 74 61 72 74 22 21 3d 3d 65 2e 6f 70 65 6e 7c 7c 28 74 Data Ascii: nnerHTML:{__html:r.title}},className:N.withTextOverflow}),y))}},"8945bca7":function(e,n,t){"use strict";t.d(n,{Z:function(){return a}});var i=t("ead71eb0");function a(e,n){const t=(0,i.useRef)();return n.setStartDateOnOpen?(t.current\|\|"start"!==e.open\|\|(t
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 76 61 6c 75 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 6a 3d 22 75 73 65 72 5f 69 64 20 76 61 6c 75 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 58 3d 22 67 65 6e 69 75 73 20 6c 65 76 65 6c 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 51 3d 22 75 73 65 72 20 6c 6f 67 67 65 64 20 69 6e 20 64 61 74 61 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 4a 3d 22 75 73 65 72 20 63 6f 75 6e 74 72 79 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f Data Ascii: value is not found in window.booking object",j="user_id value is not found in window.booking object",X="genius level is not found in window.booking object",Q="user logged in data is not found in window.booking object",J="user country is not found in windo
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 22 53 61 69 6e 74 20 4b 69 74 74 73 20 61 6e 64 20 4e 65 76 69 73 22 2c 6b 70 3a 22 4e 6f 72 74 68 20 4b 6f 72 65 61 22 2c 6b 72 3a 22 53 6f 75 74 68 20 4b 6f 72 65 61 22 2c 6b 77 3a 22 4b 75 77 61 69 74 22 2c 6b 79 3a 22 43 61 79 6d 61 6e 20 49 73 6c 61 6e 64 73 22 2c 6b 7a 3a 22 4b 61 7a 61 6b 68 73 74 61 6e 22 2c 6c 61 3a 22 4c 61 6f 73 22 2c 6c 62 3a 22 4c 65 62 61 6e 6f 6e 22 2c 6c 63 3a 22 53 61 69 6e 74 20 4c 75 63 69 61 22 2c 6c 69 3a 22 4c 69 65 63 68 74 65 6e 73 74 65 69 6e 22 2c 6c 6b 3a 22 53 72 69 20 4c 61 6e 6b 61 22 2c 6c 72 3a 22 4c 69 62 65 72 69 61 22 2c 6c 73 3a 22 4c 65 73 6f 74 68 6f 22 2c 6c 74 3a 22 4c 69 74 68 75 61 6e 69 61 22 2c 6c 75 3a 22 4c 75 78 65 6d 62 6f 75 72 67 22 2c 6c 76 3a 22 4c 61 74 76 69 61 22 2c 6c 79 3a 22 4c 69 Data Ascii: "Saint Kitts and Nevis",kp:"North Korea",kr:"South Korea",kw:"Kuwait",ky:"Cayman Islands",kz:"Kazakhstan",la:"Laos",lb:"Lebanon",lc:"Saint Lucia",li:"Liechtenstein",lk:"Sri Lanka",lr:"Liberia",ls:"Lesotho",lt:"Lithuania",lu:"Luxembourg",lv:"Latvia",ly:"Li
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 3d 28 69 3d 6e 75 6c 6c 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 72 6f 6f 6d 43 6f 75 6e 74 49 6e 66 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 72 6f 6f 6d 52 65 73 65 72 76 61 74 69 6f 6e 73 5b 30 5d 2e 72 6f 6f 6d 52 65 73 65 72 76 61 74 69 6f 6e 49 64 29 2c 61 3d 5a 6e 28 22 74 74 76 22 29 7c 7c 6f 7c 7c 75 2c 7b 65 76 65 6e 74 3a 6e 6e 2e 50 55 52 43 48 41 53 45 2c 74 73 6d 70 3a 53 6e 28 29 2c 5f 63 6c 65 61 72 3a 21 30 2c 72 69 64 3a 63 7c 7c 5f 74 28 29 7c 7c 5a 6e 28 22 72 69 64 22 29 2c 74 74 76 3a 61 2c 61 69 3a 64 2c 74 61 78 3a 52 74 28 29 7c 7c 6b 6e 2c 69 74 65 6d 73 3a 5b 7b 69 74 65 6d 5f 69 64 3a 28 6e 75 6c 6c 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 Data Ascii: =(i=null===e\|\|void 0===e?void 0:e.roomCountInfo)\|\|void 0===i?void 0:i.roomReservations[0].roomReservationId),a=Zn("ttv")\|\|o\|\|u,{event:nn.PURCHASE,tsmp:Sn(),_clear:!0,rid:c\|\|_t()\|\|Zn("rid"),ttv:a,ai:d,tax:Rt()\|\|kn,items:[{item_id:(null===e\|\|void 0===e?void
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 6e 69 74 69 6f 6e 22 2c 76 61 72 69 61 62 6c 65 3a 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 72 61 76 65 6c 50 75 72 70 6f 73 65 22 7d 7d 2c 74 79 70 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 54 72 61 76 65 6c 50 75 72 70 6f 73 65 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 44 65 66 69 6e 69 74 69 6f 6e 22 2c 76 61 72 69 61 62 6c 65 3a 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 70 72 6f 70 65 72 74 79 48 69 67 68 6c 69 67 68 74 73 43 72 69 Data Ascii: nition",variable:{kind:"Variable",name:{kind:"Name",value:"travelPurpose"}},type:{kind:"NamedType",name:{kind:"Name",value:"TravelPurpose"}},directives:[]},{kind:"VariableDefinition",variable:{kind:"Variable",name:{kind:"Name",value:"propertyHighlightsCri
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 72 65 71 75 65 73 74 54 6f 42 6f 6f 6b 45 6c 69 67 69 62 69 6c 69 74 79 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 69 73 45 6e 61 62 6c 65 64 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 72 61 6e 73 6c 61 74 69 6f Data Ascii: ame:{kind:"Name",value:"requestToBookEligibility"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"isEnabled"},arguments:[],directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"translatio
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 65 78 74 65 6e 64 65 64 41 74 74 72 69 62 75 74 65 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 50 61 72 6b 69 6e 67 41 74 74 72 69 62 Data Ascii: guments:[],directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"extendedAttributes"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"ParkingAttrib

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49845	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	671	OUT	POST /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 8603 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	8603	OUT	Data Raw: 7b 22 63 68 61 6c 6c 65 6e 67 65 22 3a 7b 22 69 6e 70 75 74 22 3a 22 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 78 4c 43 4a 31 59 6d 6c 6b 49 6a 6f 69 5a 44 5a 69 4d 6a 64 6b 4e 54 59 74 4f 44 41 79 59 79 30 30 5a 54 6b 30 4c 57 45 35 4e 57 45 74 5a 44 45 30 4e 57 45 77 59 57 56 6d 4e 47 55 77 49 69 77 69 59 58 52 30 5a 57 31 77 64 46 39 70 5a 43 49 36 49 6a 4a 6b 4f 47 46 69 59 6a 4a 69 4c 57 49 30 4e 6a 59 74 4e 44 63 35 4d 69 30 35 4d 32 51 31 4c 57 49 34 5a 54 63 33 59 54 41 7a 4f 57 46 69 4e 79 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 77 4d 53 30 78 4e 56 51 79 4d 7a 6f 78 4e 6a 6f 78 4f 43 34 77 4d 54 41 78 4d 6a 63 34 4e 6a 68 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4e 43 77 69 Data Ascii: {"challenge":{"input":"eyJ2ZXJzaW9uIjoxLCJ1YmlkIjoiZDZiMjdkNTYtODAyYy00ZTk0LWE5NWEtZDE0NWEwYWVmNGUwIiwiYXR0ZW1wdF9pZCI6IjJkOGFiYjJiLWI0NjYtNDc5Mi05M2Q1LWI4ZTc3YTAzOWFiNyIsImNyZWF0ZV90aW1lIjoiMjAyNC0wMS0xNVQyMzoxNjoxOC4wMTAxMjc4NjhaIiwiZGlmZmljdWx0eSI6NCwi
2024-01-15 23:16:19 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 296 Connection: close Date: Mon, 15 Jan 2024 23:16:19 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc3-7d37a0f71bb1a0f13bb25566 X-Cache: Miss from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9dkhuKz6xHmXvyxtRYKqMfnjWtyYXpCaRPqofNiHJyPaHeOXYFT4cg==
2024-01-15 23:16:19 UTC	296	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6a 77 4f 69 44 7a 77 71 41 41 41 41 3a 44 4c 67 57 68 4e 72 52 37 7a 59 69 42 79 42 75 44 72 7a 43 52 67 52 4e 75 37 7a 75 48 76 6f 39 31 55 78 2f 77 2b 64 72 78 35 6b 57 7a 2b 74 71 61 6f 34 31 78 57 68 56 30 47 6d 76 78 75 7a 64 61 63 67 6d 78 79 30 62 70 6a 56 2b 69 2b 61 76 50 51 62 50 57 63 74 48 53 64 78 66 68 73 38 61 53 4d 73 50 74 4a 53 35 50 33 44 59 73 32 72 6c 59 49 76 70 2b 61 44 68 4c 73 55 33 58 31 61 67 64 53 53 33 67 7a 59 6e 74 67 42 66 50 6d 6c 70 71 44 35 4f 38 54 76 2b 67 4a 73 51 43 4b 79 4b 6a 69 68 6f 68 57 48 36 43 4b 34 65 48 42 48 45 4e 46 72 73 35 33 4b 62 61 36 39 2b 75 74 4e Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjwOiDzwqAAAA:DLgWhNrR7zYiByBuDrzCRgRNu7zuHvo91Ux/w+drx5kWz+tqao41xWhV0Gmvxuzdacgmxy0bpjV+i+avPQbPWctHSdxfhs8aSMsPtJS5P3DYs2rlYIvp+aDhLsU3X1agdSS3gzYntgBfPmlpqD5O8Tv+gJsQCKyKjihohWH6CK4eHBHENFrs53Kba69+utN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49848	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	1006	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&_u=aGBAgAIJAAAAAGgMIAC~&z=1118050036 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:19 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:19 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49847	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	618	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&gjid=1707741665&_gid=1111547412.1705360577&_u=aGBAgAIJAAAAAGgMIAC~&z=1566906621 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Mon, 15 Jan 2024 23:16:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:19 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49849	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	589	OUT	GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 130895 Connection: close Date: Mon, 15 Jan 2024 08:46:38 GMT Last-Modified: Mon, 15 Jan 2024 08:33:14 GMT ETag: "8d340c5f9230be5b10b1f59d2a17b65b" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Pac9I_hNFcXXJu9.GA9ZdW.xHsF0wStl Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: HTqqax0Bt4bpwOfWjtZH84OZPZxlAjU8yi3j_C0qmOv4cmeugPNeHQ== Age: 52182 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 33 64 30 36 36 62 30 64 2e 66 64 37 64 36 64 64 66 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 33 64 30 36 36 62 30 64 22 5d 2c 7b 64 37 37 34 35 38 38 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 Data Ascii: /! For license information please see 3d066b0d.fd7d6ddf.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["3d066b0d"],{d7745882:function(e,n,i){"use strict";i.d(
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 4c 3d 22 43 4f 52 50 54 52 41 56 45 4c 22 2c 65 2e 4c 4f 4e 47 54 41 49 4c 3d 22 4c 4f 4e 47 54 41 49 4c 22 2c 65 2e 4c 4f 4e 47 54 41 49 4c 5f 41 46 46 4e 45 54 3d 22 4c 4f 4e 47 54 41 49 4c 5f 41 46 46 4e 45 54 22 2c 65 2e 4d 45 54 41 3d 22 4d 45 54 41 22 2c 65 2e 4f 54 41 3d 22 4f 54 41 22 2c 65 2e 53 49 4c 56 45 52 3d 22 53 49 4c 56 45 52 22 2c 65 2e 54 52 41 4e 53 50 4f 52 54 3d 22 54 52 41 4e 53 50 4f 52 54 22 2c 65 7d 28 7b 7d 29 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 43 52 49 54 49 43 41 4c 3d 22 43 52 49 54 49 43 41 4c 22 2c 65 2e 4c 4f 57 3d 22 4c 4f 57 22 2c 65 2e 4d 41 4a 4f 52 3d 22 4d 41 4a 4f 52 22 2c 65 2e 4d 49 4e 4f 52 3d 22 4d 49 4e 4f 52 22 2c 65 2e 56 45 52 59 5f 4c 4f 57 3d 22 56 45 52 59 5f 4c 4f 57 Data Ascii: L="CORPTRAVEL",e.LONGTAIL="LONGTAIL",e.LONGTAIL_AFFNET="LONGTAIL_AFFNET",e.META="META",e.OTA="OTA",e.SILVER="SILVER",e.TRANSPORT="TRANSPORT",e}({}),r=function(e){return e.CRITICAL="CRITICAL",e.LOW="LOW",e.MAJOR="MAJOR",e.MINOR="MINOR",e.VERY_LOW="VERY_LOW
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 6e 43 6c 69 63 6b 3a 64 2c 65 6c 65 6d 65 6e 74 3a 6c 7d 3d 65 3b 72 65 74 75 72 6e 20 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 56 65 2c 7b 75 72 6c 3a 6e 2c 69 73 54 61 72 67 65 74 42 6c 61 6e 6b 3a 69 2c 61 72 69 61 4c 61 62 65 6c 3a 74 2c 74 65 78 74 3a 72 2c 65 6c 65 6d 65 6e 74 3a 6c 2c 6f 6e 43 6c 69 63 6b 3a 64 7d 29 7d 2c 59 65 3d 65 3d 3e 7b 6c 65 74 7b 61 72 69 61 4c 61 62 65 6c 3a 6e 2c 74 65 78 74 3a 69 2c 6f 6e 43 6c 69 63 6b 3a 74 2c 63 61 6c 6c 62 61 63 6b 3a 72 2c 65 6c 65 6d 65 6e 74 3a 64 7d 3d 65 3b 72 65 74 75 72 6e 20 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 56 65 2c 7b 61 72 69 61 4c 61 62 65 6c 3a 6e 2c 74 65 78 74 3a 69 2c 6f 6e 43 6c 69 63 6b 3a 28 29 3d 3e 7b 72 28 29 2c 74 26 26 74 28 29 7d 2c 65 6c 65 Data Ascii: nClick:d,element:l}=e;return a().createElement(Ve,{url:n,isTargetBlank:i,ariaLabel:t,text:r,element:l,onClick:d})},Ye=e=>{let{ariaLabel:n,text:i,onClick:t,callback:r,element:d}=e;return a().createElement(Ve,{ariaLabel:n,text:i,onClick:()=>{r(),t&&t()},ele
2024-01-15 23:16:19 UTC	15177	IN	Data Raw: 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 65 72 6f 43 61 6d 70 61 69 67 6e 49 64 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 Data Ascii: :[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"heroCampaignId"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"designVariant"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selec
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 6f 43 6f 75 6e 74 64 6f 77 6e 43 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6d 70 61 69 67 6e 45 6e 64 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 73 69 67 6e 61 74 75 72 65 5c 6e 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 69 64 5c 6e 20 20 20 20 20 20 20 20 20 20 75 72 6c 3a 20 75 72 6c 28 77 69 64 74 68 3a 20 39 30 30 2c 20 68 65 69 67 68 74 3a 20 39 30 30 29 5c 6e 20 20 20 20 20 20 20 20 20 20 61 6c 74 5c 6e 20 20 20 20 20 20 20 Data Ascii: ion {\n text\n }\n ... on HeroCountdownCaption {\n campaignEnd\n }\n }\n signature\n backgroundImage {\n id\n url: url(width: 900, height: 900)\n alt\n
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 61 70 74 69 6f 6e 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 54 65 78 74 43 61 70 Data Ascii: "},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"caption"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"SecondaryBannerTextCap
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 44 69 72 65 63 74 4c 69 6e 6b 4c 61 6e 64 69 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c Data Ascii: nts:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"value"},arguments:[],directives:[]}]}}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"DirectLinkLanding"}},directives:[],selectionSet:{kind:"SelectionSet",sel
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 73 65 72 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 61 73 55 70 63 6f 6d 69 6e 67 42 6f 6f 6b 69 6e 67 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 61 73 4f 6e 67 6f 69 6e 67 42 6f 6f 6b 69 6e 67 22 7d 2c 61 72 67 75 6d 65 Data Ascii: e:{kind:"Name",value:"user"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"hasUpcomingBooking"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"hasOngoingBooking"},argume
2024-01-15 23:16:19 UTC	1030	IN	Data Raw: 61 6e 6e 65 72 5f 74 6f 5f 62 73 7d 3a 6d 6c 70 31 60 5d 3a 31 2c 5b 60 24 7b 70 2e 63 6c 69 63 6b 5f 73 72 5f 62 61 6e 6e 65 72 5f 74 6f 5f 62 73 7d 3a 6d 6c 70 32 60 5d 3a 32 2c 5b 60 24 7b 70 2e 63 6c 69 63 6b 5f 62 64 5f 62 61 6e 6e 65 72 5f 74 6f 5f 6c 70 7d 3a 6d 6c 70 31 60 5d 3a 33 2c 5b 60 24 7b 70 2e 63 6c 69 63 6b 5f 62 64 5f 62 61 6e 6e 65 72 5f 74 6f 5f 6c 70 7d 3a 6d 6c 70 32 60 5d 3a 34 7d 2c 45 3d 28 65 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 20 69 3d 28 65 3d 3e 7b 73 77 69 74 63 68 28 4e 75 6d 62 65 72 28 65 29 29 7b 63 61 73 65 20 35 34 3a 72 65 74 75 72 6e 22 6d 6c 70 31 22 3b 63 61 73 65 20 35 35 3a 72 65 74 75 72 6e 22 6d 6c 70 32 22 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 22 22 7d 7d 29 28 6e 29 3b 72 65 74 75 72 6e 60 24 7b 65 7d 3a Data Ascii: anner_to_bs}:mlp1`]:1,[`${p.click_sr_banner_to_bs}:mlp2`]:2,[`${p.click_bd_banner_to_lp}:mlp1`]:3,[`${p.click_bd_banner_to_lp}:mlp2`]:4},E=(e,n)=>{const i=(e=>{switch(Number(e)){case 54:return"mlp1";case 55:return"mlp2";default:return""}})(n);return`${e}:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49850	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	589	OUT	GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 83080 Connection: close Date: Mon, 15 Jan 2024 17:14:30 GMT Last-Modified: Mon, 15 Jan 2024 16:23:25 GMT ETag: "e8acd113d90ead00a8a9f3cf0530ceca" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 2JfhWBDNXPlLVY4Y7uHW7GITTlaBSUhU Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: nS27kCr0ELrau0AHvEOJG4zDk-UX73hbuLG6fzCGs-Dq_xlcRSMiLQ== Age: 21710 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 34 35 62 65 37 61 39 2e 32 31 36 37 34 66 64 66 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 34 35 62 65 37 61 39 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 445be7a9.21674fdf.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["445be7a9"],{bca1141e:function(e,t,n){"use strict";var
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2e 37 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 39 2e 35 7a 6d 33 2d 31 2e 35 68 33 2e 35 41 2e 32 35 2e 32 35 20 30 20 30 20 31 20 39 20 32 2e 37 35 76 32 2e 35 6c 2e 37 35 2d 2e 37 35 68 2d 34 2e 35 6c 2e 37 35 2e 37 35 76 2d 32 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2e 32 35 7a 6d 30 2d 31 2e 35 63 2d 2e 36 39 20 30 2d 31 2e 32 35 2e 35 36 2d 31 2e 32 35 20 31 2e 32 35 76 32 2e 35 63 30 20 2e 34 31 34 2e 33 33 36 2e 37 35 2e 37 35 2e 37 35 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 76 2d 32 2e 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 33 2e 35 7a 4d 35 2e 32 35 20 39 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 Data Ascii: .75c0-.69-.56-1.25-1.25-1.25h-9.5zm3-1.5h3.5A.25.25 0 0 1 9 2.75v2.5l.75-.75h-4.5l.75.75v-2.5a.25.25 0 0 1-.25.25zm0-1.5c-.69 0-1.25.56-1.25 1.25v2.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 .75-.75v-2.5c0-.69-.56-1.25-1.25-1.25h-3.5zM5.25 9h4.5a.75.75 0 0 0
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 45 56 3d 22 42 49 5a 44 45 56 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 45 41 44 3d 22 43 48 41 4e 4e 45 4c 5f 44 45 41 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 3d 22 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 22 2c 65 2e 43 4f 52 50 54 52 41 56 45 4c 3d 22 43 4f 52 50 54 52 41 56 45 4c 22 2c 65 2e 4c 4f 4e 47 54 41 49 4c 3d 22 4c Data Ascii: EV="BIZDEV",e.CHANNEL_DEAD="CHANNEL_DEAD",e.CHANNEL_DIRECT="CHANNEL_DIRECT",e.CHANNEL_PAID="CHANNEL_PAID",e.CHANNEL_PAID_BRAND="CHANNEL_PAID_BRAND",e.CHANNEL_SEO="CHANNEL_SEO",e.CHANNEL_SEO_BRAND="CHANNEL_SEO_BRAND",e.CORPTRAVEL="CORPTRAVEL",e.LONGTAIL="L
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 69 74 79 5d 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 7c 7c 22 22 29 28 65 29 3b 63 61 73 65 20 4c 2e 4e 72 3a 72 65 74 75 72 6e 28 65 3d 3e 5b 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 69 74 79 2c 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 61 74 69 6f 6e 2e 63 6f 75 6e 74 72 79 5d 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 7c 7c 22 22 29 28 65 29 3b 63 61 73 65 20 67 2e 69 24 3a 72 65 74 75 72 6e 28 65 3d 3e 5b 65 2e 64 69 73 74 72 69 63 74 4e 61 6d 65 2c 65 2e 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 2e 6c 6f 63 Data Ascii: basicPropertyData.location.city].filter(Boolean).join(", ")\|\|"")(e);case L.Nr:return(e=>[e.basicPropertyData.location.city,e.basicPropertyData.location.country].filter(Boolean).join(", ")\|\|"")(e);case g.i$:return(e=>[e.districtName,e.basicPropertyData.loc
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 75 63 74 55 72 6c 29 28 7b 70 61 74 68 6e 61 6d 65 3a 60 2f 73 65 61 72 63 68 72 65 73 75 6c 74 73 24 7b 22 65 6e 2d 75 73 22 3d 3d 3d 43 3f 22 22 3a 22 2e 22 2b 43 7d 2e 68 74 6d 6c 60 7d 29 2c 44 3d 4c 2e 73 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 41 26 26 49 26 26 28 44 2e 73 65 74 28 22 63 68 65 63 6b 69 6e 22 2c 41 29 2c 44 2e 73 65 74 28 22 63 68 65 63 6b 6f 75 74 22 2c 49 29 29 2c 64 26 26 75 26 26 28 44 2e 73 65 74 28 22 64 65 73 74 5f 69 64 22 2c 53 74 72 69 6e 67 28 64 29 29 2c 44 2e 73 65 74 28 22 64 65 73 74 5f 74 79 70 65 22 2c 53 74 72 69 6e 67 28 75 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 45 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 Data Ascii: uctUrl)({pathname:`/searchresults${"en-us"===C?"":"."+C}.html`}),D=L.searchParams;if(A&&I&&(D.set("checkin",A),D.set("checkout",I)),d&&u&&(D.set("dest_id",String(d)),D.set("dest_type",String(u).toLowerCase())),"undefined"!==typeof E&&"undefined"!==typeof
2024-01-15 23:16:19 UTC	1160	IN	Data Raw: 79 3d 65 2e 67 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 29 2c 74 68 69 73 2e 24 4d 3d 65 2e 67 65 74 55 54 43 4d 6f 6e 74 68 28 29 2c 74 68 69 73 2e 24 44 3d 65 2e 67 65 74 55 54 43 44 61 74 65 28 29 2c 74 68 69 73 2e 24 57 3d 65 2e 67 65 74 55 54 43 44 61 79 28 29 2c 74 68 69 73 2e 24 48 3d 65 2e 67 65 74 55 54 43 48 6f 75 72 73 28 29 2c 74 68 69 73 2e 24 6d 3d 65 2e 67 65 74 55 54 43 4d 69 6e 75 74 65 73 28 29 2c 74 68 69 73 2e 24 73 3d 65 2e 67 65 74 55 54 43 53 65 63 6f 6e 64 73 28 29 2c 74 68 69 73 2e 24 6d 73 3d 65 2e 67 65 74 55 54 43 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 28 29 7d 65 6c 73 65 20 6f 2e 63 61 6c 6c 28 74 68 69 73 29 7d 3b 76 61 72 20 73 3d 69 2e 75 74 63 4f 66 66 73 65 74 3b 69 2e 75 74 63 4f 66 66 73 65 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: y=e.getUTCFullYear(),this.$M=e.getUTCMonth(),this.$D=e.getUTCDate(),this.$W=e.getUTCDay(),this.$H=e.getUTCHours(),this.$m=e.getUTCMinutes(),this.$s=e.getUTCSeconds(),this.$ms=e.getUTCMilliseconds()}else o.call(this)};var s=i.utcOffset;i.utcOffset=function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49851	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	589	OUT	GET /psb/capla/static/js/53a8d0d3.088af158.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 39899 Connection: close Last-Modified: Fri, 12 Jan 2024 16:20:07 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: cq.w8nThooW5lpdXy6gvO1vlXFV9_4Pr Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:38:17 GMT ETag: "737b7a6087d435f836f109fca288b92c" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec809871438c11b540493503de981368.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Z-dql0LNzgKPcWfTRTizpoKikVxPoqAfF9csCvOHqVSZOltNtuqLsw== Age: 23883 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 35 33 61 38 64 30 64 33 2e 30 38 38 61 66 31 35 38 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 35 33 61 38 64 30 64 33 22 5d 2c 7b 22 35 31 61 33 38 38 63 33 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 Data Ascii: /! For license information please see 53a8d0d3.088af158.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["53a8d0d3"],{"51a388c3":function(e,t,n){"use strict";va
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5f 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 75 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 2c 61 3d 6e 2e 6e 28 72 29 2c 69 3d 6e 28 22 35 38 66 66 31 33 37 35 22 29 2c 45 3d 6e 28 22 38 31 34 62 64 39 64 33 22 29 2c 5f 3d 6e 28 22 30 37 38 38 64 61 38 33 22 29 2c 63 3d 6e 28 22 61 37 30 64 36 62 38 65 22 29 2c 6f 3d 6e 28 22 33 33 37 64 63 38 33 61 22 29 2c 75 3d 6e 28 22 62 63 61 34 62 32 37 37 22 29 2c 49 3d 6e 28 22 31 63 30 66 63 66 32 62 22 29 2c 41 3d 6e 28 22 31 34 32 34 64 30 33 33 22 29 2c 73 3d 6e 28 22 61 62 65 31 Data Ascii: 8":function(e,t,n){"use strict";n.d(t,{__:function(){return l},uI:function(){return R}});var r=n("ead71eb0"),a=n.n(r),i=n("58ff1375"),E=n("814bd9d3"),_=n("0788da83"),c=n("a70d6b8e"),o=n("337dc83a"),u=n("bca4b277"),I=n("1c0fcf2b"),A=n("1424d033"),s=n("abe1
2024-01-15 23:16:19 UTC	7817	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 77 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 79 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 22 32 38 64 62 64 31 33 32 22 29 3b 63 6f 6e 73 74 20 61 3d 65 3d 3e 65 3f 72 2e 65 78 70 60 63 43 48 4f 62 45 66 45 49 54 4e 50 66 62 65 51 4d 49 61 57 59 55 51 4a 46 46 51 63 4f 4f 49 42 42 4f 60 3a 72 2e 65 78 70 60 63 43 48 4f 62 45 66 45 49 54 4e 50 66 62 65 51 4d 49 61 57 59 55 51 4a 46 46 51 63 63 43 63 43 63 43 43 60 2c 69 3d 65 3d 3e 7b 28 30 2c 72 2e 74 72 61 63 6b 43 75 73 74 6f 6d 47 6f 61 6c 29 28 61 28 65 29 2c 31 29 7d 2c 45 3d 65 3d 3e 7b 28 30 2c 72 2e 74 72 61 63 6b 43 75 73 74 6f 6d 47 6f 61 6c 29 28 61 28 65 29 Data Ascii: ction(){return E},w7:function(){return o},yg:function(){return c}});var r=n("28dbd132");const a=e=>e?r.exp`cCHObEfEITNPfbeQMIaWYUQJFFQcOOIBBO`:r.exp`cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC`,i=e=>{(0,r.trackCustomGoal)(a(e),1)},E=e=>{(0,r.trackCustomGoal)(a(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49854	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	597	OUT	GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	826	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:19 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Tue, 05 Dec 2023 03:37:38 GMT ETag: 0x8DBF543876E798E x-ms-request-id: 9b919782-101e-008a-6b83-276232000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 57425 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d365f81107b7-IAD
2024-01-15 23:16:19 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ic
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f Data Ascii: ync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#o
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 Data Ascii: ackground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scr
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 Data Ascii: netrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inp
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 Data Ascii: ay:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c Data Ascii: #onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 Data Ascii: sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c Data Ascii: er-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 Data Ascii: k-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49855	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	433	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:19 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d366282d07bb-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 40600 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:16:19 GMT Last-Modified: Fri, 17 Nov 2023 13:58:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: CoP2FogSq6tLD5K02GDrqw== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1f2a4218-b01e-002a-0ae7-1de693000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:16:19 UTC	467	IN	Data Raw: 37 63 31 33 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c13{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 Data Ascii: kiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysAct
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 70 72 65 66 65 72 65 6e 63 65 73 22 2c Data Ascii: ition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage cookie preferences",
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 Data Ascii: e technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selected currency, langua
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 22 3a 22 50 61 74 74 65 72 6e 7c 5f 64 63 5f 67 74 6d 5f 55 41 2d 22 2c 22 69 64 22 3a 22 63 31 36 31 63 63 63 65 2d 34 65 62 34 2d 34 61 31 32 2d 61 33 62 65 2d 36 34 36 32 32 36 66 30 39 65 39 30 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f 61 64 20 6f 74 68 65 72 20 73 63 72 69 70 74 73 20 61 6e 64 20 63 6f 64 Data Ascii: ":"Pattern\|_dc_gtm_UA-","id":"c161ccce-4eb4-4a12-a3be-646226f09e90","Name":"_dc_gtm_UA-xxxxxxxx","Host":"booking.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to load other scripts and cod
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 67 61 74 69 6f 6e 20 73 6f 6c 75 74 69 6f 6e 2c 20 74 6f 20 66 6c 61 67 20 66 65 61 74 75 72 65 73 20 66 6f 72 20 62 72 6f 77 73 65 72 20 64 65 74 65 63 74 69 6f 6e 20 61 6e 64 20 64 69 73 74 69 6e 67 75 69 73 68 69 6e 67 20 77 68 65 74 68 65 72 20 69 74 20 69 73 20 61 20 72 65 61 6c 20 75 73 65 72 20 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 62 6f 74 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 30 65 61 38 61 34 30 33 2d 33 32 64 64 2d 34 35 32 64 2d 62 35 65 62 2d 37 30 64 33 31 36 61 33 31 61 36 66 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 63 63 63 22 2c 22 48 6f 73 74 22 3a 22 63 66 2e 62 73 74 Data Ascii: gation solution, to flag features for browser detection and distinguishing whether it is a real user or malicious bot.","patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"0ea8a403-32dd-452d-b5eb-70d316a31a6f","Name":"_pxff_ccc","Host":"cf.bst
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 35 65 32 35 66 65 63 32 2d 37 30 38 30 2d 34 32 61 30 2d 39 35 34 36 2d 66 39 63 36 30 35 65 64 32 36 39 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 66 70 22 2c 22 48 6f 73 74 22 3a 22 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 Data Ascii: n":"Dropped by Security team as part of PerimeterX security services.","patternKey":null,"thirdPartyKey":"","firstPartyKey":"","id":"5e25fec2-7080-42a0-9546-f9c605ed269c","Name":"_pxff_fp","Host":"account.booking.com","IsSession":false,"Length":"0","descr
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4f 77 6e 65 64 20 62 79 20 6f 75 72 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 2e 20 55 73 65 64 20 66 6f 72 20 62 6f 74 20 64 65 74 65 63 74 69 6f 6e 20 76 69 61 20 61 6e 20 65 78 74 65 72 6e 61 6c 20 73 6f 75 72 63 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 2f 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 Data Ascii: :false,"Length":"365","description":"Owned by our Security team. Used for bot detection via an external source: https://www.perimeterx.com/","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"Dropped by Security team as part
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 75 73 65 64 20 74 6f 20 61 74 74 72 69 62 75 74 65 20 62 6f 6f 6b 69 6e 67 73 20 74 6f 20 74 68 65 20 63 6f 72 72 65 63 74 20 70 61 72 74 6e 65 72 20 6f 72 20 62 75 73 69 6e 65 73 73 20 65 6e 74 69 74 79 20 61 6e 64 20 69 73 20 66 75 6e 64 61 6d 65 6e 74 61 6c 20 74 6f 20 6f 75 72 20 77 68 69 74 65 20 6c 61 62 65 6c 20 62 75 73 69 6e 65 73 73 20 6d 6f 64 65 6c 2e 20 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 Data Ascii: .com","IsSession":true,"Length":"0","description":"This cookie is used to attribute bookings to the correct partner or business entity and is fundamental to our white label business model. ","DurationType":1,"category":null,"isThirdParty":false},{"thirdPa
2024-01-15 23:16:19 UTC	1369	IN	Data Raw: 66 32 61 61 61 22 2c 22 4e 61 6d 65 22 3a 22 62 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 52 65 6d 65 6d 62 65 72 73 20 69 66 20 74 68 65 20 75 73 65 72 20 68 61 73 20 62 65 65 6e 20 61 73 6b 65 64 20 61 20 6d 61 78 2e 20 6f 66 20 74 68 72 65 65 20 74 69 6d 65 73 20 61 62 6f 75 74 20 68 69 73 2f 68 65 72 20 6c 61 6e 67 75 61 67 65 20 73 65 74 74 69 6e 67 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f Data Ascii: f2aaa","Name":"b","Host":"booking.com","IsSession":false,"Length":"30","description":"Remembers if the user has been asked a max. of three times about his/her language setting.","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescriptio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49858	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	404	OUT	GET /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:19 GMT X-Cache: Error from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9Fqndr4a7X0NZfMY8TapcRdvlaYUJiZAz0Hp88bzCcVux8rHNN1HRw==
2024-01-15 23:16:19 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49859	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	589	OUT	GET /psb/capla/static/js/cfbdd235.aa2e272b.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 84412 Connection: close Last-Modified: Thu, 11 Jan 2024 13:30:25 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y8OUFvU19z2dFh0WRcFs1.NiTpnGRuoL Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 14:53:58 GMT ETag: "dc1f07d2123b75a7dd2f78fe76d8f26f" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: pfiJndCCmvBrePftjpE6ENOkVgpahhBkrbLWH-0SOdPnfjuN8WS92g== Age: 30142 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 66 62 64 64 32 33 35 2e 61 61 32 65 32 37 32 62 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 66 62 64 64 32 33 35 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see cfbdd235.aa2e272b.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["cfbdd235"],{bca1141e:function(e,t,n){"use strict";var
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 2e 37 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 39 2e 35 7a 6d 33 2d 31 2e 35 68 33 2e 35 41 2e 32 35 2e 32 35 20 30 20 30 20 31 20 39 20 32 2e 37 35 76 32 2e 35 6c 2e 37 35 2d 2e 37 35 68 2d 34 2e 35 6c 2e 37 35 2e 37 35 76 2d 32 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 2d 2e 32 35 2e 32 35 7a 6d 30 2d 31 2e 35 63 2d 2e 36 39 20 30 2d 31 2e 32 35 2e 35 36 2d 31 2e 32 35 20 31 2e 32 35 76 32 2e 35 63 30 20 2e 34 31 34 2e 33 33 36 2e 37 35 2e 37 35 2e 37 35 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 76 2d 32 2e 35 63 30 2d 2e 36 39 2d 2e 35 36 2d 31 2e 32 35 2d 31 2e 32 35 2d 31 2e 32 35 68 2d 33 2e 35 7a 4d 35 2e 32 35 20 39 68 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 Data Ascii: .75c0-.69-.56-1.25-1.25-1.25h-9.5zm3-1.5h3.5A.25.25 0 0 1 9 2.75v2.5l.75-.75h-4.5l.75.75v-2.5a.25.25 0 0 1-.25.25zm0-1.5c-.69 0-1.25.56-1.25 1.25v2.5c0 .414.336.75.75.75h4.5a.75.75 0 0 0 .75-.75v-2.5c0-.69-.56-1.25-1.25-1.25h-3.5zM5.25 9h4.5a.75.75 0 0 0
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 45 56 3d 22 42 49 5a 44 45 56 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 45 41 44 3d 22 43 48 41 4e 4e 45 4c 5f 44 45 41 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 3d 22 43 48 41 4e 4e 45 4c 5f 44 49 52 45 43 54 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 50 41 49 44 5f 42 52 41 4e 44 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 22 2c 65 2e 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 3d 22 43 48 41 4e 4e 45 4c 5f 53 45 4f 5f 42 52 41 4e 44 22 2c 65 2e 43 4f 52 50 54 52 41 56 45 4c 3d 22 43 4f 52 50 54 52 41 56 45 4c 22 2c 65 2e 4c 4f 4e 47 54 41 49 4c 3d 22 4c Data Ascii: EV="BIZDEV",e.CHANNEL_DEAD="CHANNEL_DEAD",e.CHANNEL_DIRECT="CHANNEL_DIRECT",e.CHANNEL_PAID="CHANNEL_PAID",e.CHANNEL_PAID_BRAND="CHANNEL_PAID_BRAND",e.CHANNEL_SEO="CHANNEL_SEO",e.CHANNEL_SEO_BRAND="CHANNEL_SEO_BRAND",e.CORPTRAVEL="CORPTRAVEL",e.LONGTAIL="L
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 63 65 49 6e 63 6c 75 64 65 64 22 69 6e 20 74 26 26 74 2e 69 73 42 6c 6f 63 6b 73 50 72 69 63 65 49 6e 63 6c 75 64 65 64 26 26 61 2e 73 65 74 28 22 73 72 5f 70 72 69 5f 62 6c 6f 63 6b 73 22 2c 70 28 74 2e 62 6c 6f 63 6b 73 2c 21 30 29 29 7d 28 30 2c 76 2e 43 33 29 28 72 29 26 26 69 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 76 2e 77 33 2c 76 2e 48 29 2c 22 69 73 42 65 61 63 68 4b 65 79 55 66 69 22 69 6e 20 74 26 26 74 2e 69 73 42 65 61 63 68 4b 65 79 55 66 69 26 26 61 2e 73 65 74 28 22 66 72 6f 6d 5f 62 65 61 63 68 5f 6b 65 79 5f 75 66 69 5f 73 72 22 2c 22 31 22 29 2c 22 69 73 42 65 61 63 6b 4e 6f 6e 4b 65 79 55 66 69 22 69 6e 20 74 26 26 74 2e 69 73 42 65 61 63 6b 4e 6f 6e 4b 65 79 55 66 69 26 26 61 2e 73 65 74 28 22 66 72 6f 6d 5f 62 65 61 63 Data Ascii: ceIncluded"in t&&t.isBlocksPriceIncluded&&a.set("sr_pri_blocks",p(t.blocks,!0))}(0,v.C3)(r)&&i.searchParams.set(v.w3,v.H),"isBeachKeyUfi"in t&&t.isBeachKeyUfi&&a.set("from_beach_key_ufi_sr","1"),"isBeackNonKeyUfi"in t&&t.isBeackNonKeyUfi&&a.set("from_beac
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 22 70 6f 70 75 6c 61 72 5f 6e 65 61 72 62 79 5f 6c 61 6e 64 6d 61 72 6b 73 22 2c 46 49 4c 54 45 52 5f 44 49 53 54 41 4e 43 45 3a 22 64 69 73 74 61 6e 63 65 22 2c 46 49 4c 54 45 52 5f 53 45 4f 5f 54 48 45 4d 45 3a 22 73 74 68 22 2c 46 49 4c 54 45 52 5f 48 45 41 4c 54 48 5f 41 4e 44 5f 48 59 47 49 45 4e 45 3a 22 68 65 61 6c 74 68 5f 61 6e 64 5f 68 79 67 69 65 6e 65 22 2c 46 49 4c 54 45 52 5f 4e 55 4d 5f 42 45 44 53 3a 22 6e 75 6d 5f 62 65 64 73 22 2c 46 49 4c 54 45 52 5f 54 4f 50 5f 44 45 53 54 49 4e 41 54 49 4f 4e 53 3a 22 74 6f 70 5f 64 65 73 74 69 6e 61 74 69 6f 6e 73 22 2c 46 49 4c 54 45 52 5f 50 4f 50 55 4c 41 52 3a 22 70 6f 70 75 6c 61 72 22 2c 46 49 4c 54 45 52 5f 50 4f 50 55 4c 41 52 5f 53 54 49 43 4b 59 3a 22 70 6f 70 75 6c 61 72 5f 73 74 69 63 6b Data Ascii: "popular_nearby_landmarks",FILTER_DISTANCE:"distance",FILTER_SEO_THEME:"sth",FILTER_HEALTH_AND_HYGIENE:"health_and_hygiene",FILTER_NUM_BEDS:"num_beds",FILTER_TOP_DESTINATIONS:"top_destinations",FILTER_POPULAR:"popular",FILTER_POPULAR_STICKY:"popular_stick
2024-01-15 23:16:20 UTC	2492	IN	Data Raw: 3a 72 3f 6e 65 77 20 44 61 74 65 28 44 61 74 65 2e 55 54 43 28 54 2c 41 2c 6d 2c 49 2c 68 2c 4e 2c 76 29 29 3a 6e 65 77 20 44 61 74 65 28 54 2c 41 2c 6d 2c 49 2c 68 2c 4e 2c 76 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 22 22 29 7d 7d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 69 2e 70 61 72 73 65 3b 69 2e 70 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 2e 64 61 74 65 2c 69 3d 74 2e 75 74 63 2c 6f 3d 74 2e 61 72 67 73 3b 74 68 69 73 2e 24 75 3d 69 3b 76 61 72 20 73 3d 6f 5b 31 5d 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 73 29 7b 76 61 72 20 63 3d 21 30 3d 3d 3d 6f 5b 32 5d 2c 75 3d Data Ascii: :r?new Date(Date.UTC(T,A,m,I,h,N,v)):new Date(T,A,m,I,h,N,v)}catch(e){return new Date("")}};return function(t,n,r){var i=n.prototype,a=i.parse;i.parse=function(t){var n=t.date,i=t.utc,o=t.args;this.$u=i;var s=o[1];if("string"==typeof s){var c=!0===o[2],u=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49860	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	665	OUT	GET /psb/capla/static/media/world-map.7d457a5d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	620	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 7367 Connection: close Last-Modified: Fri, 12 Jan 2024 13:21:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: _WxqA.ykv2FAu2X.15o3wW2f_BE35Gt3 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:14:48 GMT ETag: "a2bdd966488047aaa17dcebc5238432b" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: EJfyl5CibI8MeWZ9vmR9xro7clN0XSNgLZ27gyPI4ZB2BbssLf85hQ== Age: 25292 Vary: Origin
2024-01-15 23:16:19 UTC	7367	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 08 00 00 01 54 08 03 00 00 00 76 86 34 40 00 00 00 6c 50 4c 54 45 00 00 00 f7 f7 f7 f4 f4 f4 f7 f7 f7 f7 f7 f7 f6 f6 f6 f7 f7 f7 f9 f9 f9 f8 f8 f8 ff ff ff fa fa fa f8 f8 f8 f9 f9 f9 f8 f8 f8 f8 f8 f8 f8 f8 f8 f9 f9 f9 f8 f8 f8 f9 f9 f9 f8 f8 f8 f5 f5 f5 f8 f8 f8 ef ef ef f9 f9 f9 f9 f9 f9 fa fa fa f6 f6 f6 f7 f7 f7 fa fa fa fa fa fa f8 f8 f8 f8 f8 f8 ff ff ff f7 f7 f7 f6 f6 f6 f6 f6 f6 47 7d 83 78 00 00 00 24 74 52 4e 53 00 20 30 40 60 70 80 9f af 10 8f bf 50 df ff ef cf 90 7f 70 50 cf 10 af ef 30 90 a0 5f 2f 6f 8f 1f c0 b0 d0 06 a3 39 c9 00 00 1b e6 49 44 41 54 78 01 ec db e7 62 e2 30 0c 07 70 c9 f2 52 14 c9 61 f5 f6 7a ff 97 64 86 a6 50 2e 81 b4 84 1b bf 2f 37 bb 82 87 fc 97 81 7f 01 3a f2 21 a6 Data Ascii: PNGIHDRTv4@lPLTEG}x$tRNS 0@`pPpP0_/o9IDATxb0pRazdP./7:!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49861	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	771	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=810723182.1705360577&jid=1203477281&_u=aGBAgAIJAAAAAGgMIAC~&z=1118050036 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:19 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:19 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:19 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49856	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2483 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1705360547988&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-01-15 23:16:19 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-01-15 23:16:19 UTC	2482	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-01-15 23:16:20 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2AC847AD11294FBBA7397AA13470C582 Ref B: PAOEDGE0506 Ref C: 2024-01-15T23:16:19Z Date: Mon, 15 Jan 2024 23:16:20 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1705360579.194943ec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49862	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	679	OUT	GET /xdata/images/city/600x600/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 23 Dec 2023 11:57:00 GMT ETag: "045e691b7a2e5cb1c4e8558e8ef4cc99fbf77f86" Content-Language: 79443 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: kBZ9yTMPQAjLyLjXFLNJOeAza9PtlDF-gL0A2oWxSQEBBTonNM_F_Q== Age: 2027959
2024-01-15 23:16:19 UTC	16384	IN	Data Raw: 66 62 64 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: fbd4JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: 96 dc 4f 6d 77 18 4c 45 14 91 db 2b 7a ac 78 0d f4 cf 06 b7 2d 74 97 8e eb 48 8f 1f b8 b3 85 e5 91 f0 48 4f de 39 03 df 9c 01 5a 36 ba 30 fb 3c 71 44 59 41 73 23 bc b1 86 72 c7 8e 33 90 3a 0f 52 2b cf a5 4d ba ae eb 66 ff 00 33 d3 78 c8 c3 0d 15 7d 6d f9 9e 77 6d f0 f6 3b bd 35 2e 6d 63 92 0b 8c 1c b6 d2 54 f4 2b fa 63 a7 3c f4 35 98 fa 06 b7 63 34 b1 5c 69 57 ae 23 00 b3 a2 bb ae 0f 43 91 c6 2b d8 24 d3 51 14 34 97 73 23 a9 dc df 3e f7 6c 76 24 e4 60 f7 03 d6 aa c3 a9 59 ea 16 57 3e 6c 57 16 f6 b1 4a 63 33 3e 63 60 d9 c0 64 23 9e fd bf 1e f5 df 52 37 e8 79 34 71 73 83 7a dd 1e 4f 69 aa 49 a6 c8 1e d7 77 0d 96 88 9f d7 06 ba 0b cd 45 35 49 52 ed 51 90 48 80 6d 61 8c 11 c1 fc 32 0e 3d ab b4 b8 d1 ac f5 cb 33 70 65 37 f1 65 a3 cd da 61 8e 18 e4 a4 83 e7 4c Data Ascii: OmwLE+zx-tHHO9Z60<qDYAs#r3:R+Mf3x}mwm;5.mcT+c<5c4\iW#C+$Q4s#>lv$`YW>lWJc3>c`d#R7y4qszOiIwE5IRQHma2=3pe7eaL
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: 0b 3b 67 bc be 8a dd 33 99 18 2f d0 77 3f 95 71 d7 a8 db e4 47 bd 95 e1 d4 29 ba f3 fe 91 8e 6d 35 2b 5d b9 31 92 eb bf 2d d4 8f 5a d8 f0 c4 97 50 6b f6 cd 2c c8 8a ec 63 21 17 ae 46 07 eb 8a d6 f1 6d b2 db ea 36 eb 1a e2 3f b3 aa 81 e9 82 47 f8 56 14 32 9b 79 a3 95 7e f2 30 61 f5 ac 5b 70 9f a1 e9 41 fd 63 0f 7f e6 47 ab a4 61 5b 3d 4f a9 eb 55 f5 4d 41 34 db 09 2e 18 64 8e 15 7f bc 7d 2a c4 4e 25 45 91 79 56 50 47 d0 d6 27 8b a1 79 74 60 c8 a4 88 e5 0c d8 ec 30 46 7f 32 2b be 72 b4 1b 47 ca e1 e9 a9 d6 8c 25 b3 67 17 a8 dc cb aa b9 7b b7 2e 4f 41 d9 7e 95 9d 6d a2 6a 52 4c 46 98 ad 2e 3a a7 61 f8 9e 05 5b 07 9a e9 fc 2b aa db da 89 2d 27 22 33 23 6e 57 3d 09 c6 30 6b 82 9f bf 2b 49 9f 51 89 6e 85 1b d2 8e c7 3c 74 6d 72 11 9b bd 3a 56 51 fc 31 32 b0 fc Data Ascii: ;g3/w?qG)m5+]1-ZPk,c!Fm6?GV2y~0a[pAcGa[=OUMA4.d}*N%EyVPG'yt`0F2+rG%g{.OA~mjRLF.:a[+-'"3#nW=0k+IQn<tmr:VQ12
2024-01-15 23:16:20 UTC	15324	IN	Data Raw: e2 b8 1f 14 e9 5a 8e b1 a8 b2 0d 42 08 ad 55 94 6d 39 3c 75 c6 07 04 fd 7a f6 1c 54 ca 5c aa ec 6a 37 35 f5 7d 6b c3 da 95 9c fa 7d c5 f4 0e 1d 71 90 03 ed 3d 88 f7 ef 5e 75 a8 78 5f 44 40 57 47 d6 24 7b 92 49 0a d8 55 ea 7a 10 3a e4 56 d1 d2 e0 b4 41 67 69 35 ba b3 9d af 3b af 00 f0 7e 55 e7 83 cf 3f e1 58 73 78 7d d0 c9 e4 5e db 5c dc f4 d8 49 42 78 ed c7 4f c7 d3 1e b5 c5 2a 8e a7 d9 36 e4 e5 ea 73 0d a8 5e d8 5e c4 f3 48 c2 e6 dc 95 59 8f 24 82 08 c6 4f b1 23 a5 75 d6 f7 17 3e 2b b5 91 66 bb 65 78 50 b2 82 bd 00 c6 72 40 19 cf a0 e9 58 f1 69 72 c9 7a 62 bb b7 74 bd 8f 05 60 75 dd bb 27 b7 a8 ed 9e df 9d 6f a2 c1 61 e2 28 99 4c 68 d2 59 b0 9b 6b 07 55 71 c6 38 e3 aa 9e 95 c5 5a 56 76 ea 69 15 a0 ed 0a 16 8b 44 d5 6e a6 c2 4e 8a 2d cb 34 99 04 93 cf e3 Data Ascii: ZBUm9<uzT\j75}k}q=^ux_D@WG${IUz:VAgi5;~U?Xsx}^\IBxO*6s^^HY$O#u>+fexPr@Xirzbt`u'oa(LhYkUq8ZVviDnN-4
2024-01-15 23:16:20 UTC	12792	IN	Data Raw: 33 31 66 30 0d 0a 40 b8 d3 56 29 04 f2 4a d2 3c 98 19 31 b3 85 3b 5b af 61 ed d3 da bc d5 c6 d9 19 71 8e 7a 0a f4 ad 2a 58 f4 11 a9 4d 26 a3 2d fb dc 1d c8 8c ae 16 3c 67 a6 7e a3 f2 af 37 73 be e1 8e 3a b1 e9 f5 af a1 c9 e1 cb ce fd 0f 95 cf a5 75 05 eb fa 12 88 94 26 49 e6 a0 71 82 79 1c 55 c0 36 8f 5e 6a 9c e3 0e 71 5e ca 67 81 25 66 77 36 ab 68 fa 76 9e 97 8a 82 0f 28 6f 76 fe 15 20 64 fa 70 32 7a 76 ac 3b cf 0d c1 0c b7 91 40 d2 48 60 25 51 da 32 4e 07 3c 11 81 cf af b5 74 da 65 a4 d3 69 96 86 18 86 5a d9 15 9b 03 ee e3 a6 7d 2b 4e 3d 2a ef cd f3 5a e5 e3 93 9f 99 0e 5b 9e bc 9c 57 ca 62 b9 7d ac 9b 7d 4f b8 c2 42 4e 8c 6c ba 1c 7e a5 14 51 f8 44 c4 f7 31 ef fd d6 c8 54 67 77 ce b9 07 3e d8 ae b2 0b 1b 79 34 48 51 9a 5f 35 87 18 42 ca 9c e3 20 0f ce Data Ascii: 31f0@V)J<1;[aqzXM&-<g~7s:u&IqyU6^jq^g%fw6hv(ov dp2zv;@H`%Q2N<teiZ}+N=Z[Wb}}OBNl~QD1Tgw>y4HQ_5B
2024-01-15 23:16:20 UTC	2198	IN	Data Raw: 38 38 66 0d 0a 28 e7 a6 79 ef 4a 72 08 56 c1 f5 21 7d fd 2b c4 bb 3d fb 22 61 30 1f 2e ec f6 c8 a6 19 18 a9 47 18 c7 00 fa fb e6 86 c0 53 80 40 1d 6a 31 cf 03 23 ea b8 a2 ec 56 44 c3 68 e7 27 1f 5a 69 90 6e c1 04 73 ce 69 02 9f 50 01 fd 2a 33 bd 81 1b 80 03 a6 07 5a 2e c2 c8 9b 20 71 8c f7 ea 29 81 c3 1f 9b 76 47 04 7a d4 7e 5b 31 c0 71 d3 38 e6 80 10 15 56 66 04 83 8c 29 c7 18 ef 8c 0e b4 5c 76 25 2c 08 3c 73 d7 8a 55 61 8c 16 ef 51 10 08 c7 39 fe 74 75 e4 03 9f af ff 00 5e 95 c2 c7 07 e3 f0 d2 6a d6 aa b9 72 61 e3 d4 fc c6 b9 e8 74 d3 1e d9 27 2b d7 ee 66 b5 fc 6d 31 6d 75 10 9c 18 a2 03 82 7b e4 ff 00 5a cc 8a ed 63 b0 d9 2c 9b e5 c9 da 3e f6 38 e3 27 eb fc eb ec f2 f4 d6 16 1e 87 c1 66 32 8b c6 54 6f b9 26 a8 99 b5 85 c1 18 c9 18 ff 00 3f 4a b1 e0 e1 Data Ascii: 88f(yJrV!}+="a0.GS@j1#VDh'ZinsiP*3Z. q)vGz~[1q8Vf)\v%,<sUaQ9tu^jrat'+fm1mu{Zc,>8'f2To&?J
2024-01-15 23:16:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49866	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	393	OUT	GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	826	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:19 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Tue, 05 Dec 2023 03:37:38 GMT ETag: 0x8DBF543876E798E x-ms-request-id: 1e506ba7-601e-004b-465f-27c5d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 50075 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d368db0b1725-IAD
2024-01-15 23:16:20 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ic
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f Data Ascii: ync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#o
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 Data Ascii: ackground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scr
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 Data Ascii: netrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inp
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 Data Ascii: ay:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c Data Ascii: #onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 Data Ascii: sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c Data Ascii: er-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,
2024-01-15 23:16:20 UTC	1369	IN	Data Raw: 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 Data Ascii: k-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49867	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:19 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 1785 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:19 UTC	1785	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6a 77 4f 69 44 7a 77 71 41 41 41 41 3a 44 4c 67 57 68 4e 72 52 37 7a 59 69 42 79 42 75 44 72 7a 43 52 67 52 4e 75 37 7a 75 48 76 6f 39 31 55 78 2f 77 2b 64 72 78 35 6b 57 7a 2b 74 71 61 6f 34 31 78 57 68 56 30 47 6d 76 78 75 7a 64 61 63 67 6d 78 79 30 62 70 6a 56 2b 69 2b 61 76 50 51 62 50 57 63 74 48 53 64 78 66 68 73 38 61 53 4d 73 50 74 4a 53 35 50 33 44 59 73 32 72 6c 59 49 76 70 2b 61 44 68 4c 73 55 33 58 31 61 67 64 53 53 33 67 7a 59 6e 74 67 42 66 50 6d 6c 70 71 44 35 4f 38 54 76 2b 67 4a 73 51 43 4b 79 4b 6a 69 68 6f 68 57 48 36 43 4b 34 65 48 42 48 45 4e 46 72 73 35 33 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjwOiDzwqAAAA:DLgWhNrR7zYiByBuDrzCRgRNu7zuHvo91Ux/w+drx5kWz+tqao41xWhV0Gmvxuzdacgmxy0bpjV+i+avPQbPWctHSdxfhs8aSMsPtJS5P3DYs2rlYIvp+aDhLsU3X1agdSS3gzYntgBfPmlpqD5O8Tv+gJsQCKyKjihohWH6CK4eHBHENFrs53
2024-01-15 23:16:20 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 860 Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc3-66e0ae3d35ab7f2f0f8e0ba1 X-Cache: Miss from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AAfiikCLAtClFPrtt_GXvIUEJBDmRrbANG1x8dNkde9RUAMgnQja4w==
2024-01-15 23:16:20 UTC	860	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 63 53 61 68 32 6d 6c 50 41 41 41 41 3a 7a 4c 41 44 6c 4e 32 58 5a 74 67 4c 69 45 77 48 64 56 43 30 46 46 64 36 68 35 79 65 43 6e 6e 78 62 31 53 50 65 52 39 35 6e 6f 75 74 46 56 48 7a 59 6b 69 64 43 6d 6b 75 49 7a 69 4b 42 5a 72 63 41 56 54 6f 70 36 31 4d 2b 48 6e 6c 47 6b 32 4f 59 46 69 52 42 2f 71 30 37 56 43 48 6b 65 68 67 31 4d 47 51 4d 47 6f 33 55 6c 30 70 31 70 6f 59 57 6f 73 46 51 58 41 70 48 68 4a 70 30 75 48 66 79 43 6c 63 32 69 62 2f 4e 51 2b 31 6e 48 62 53 43 4f 43 42 57 65 48 51 58 78 55 47 4b 63 38 56 36 6f 4c 76 63 67 2b 62 61 41 36 76 6d 5a 41 33 36 55 71 59 50 72 70 64 61 33 4b 2f 52 44 54 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAcSah2mlPAAAA:zLADlN2XZtgLiEwHdVC0FFd6h5yeCnnxb1SPeR95noutFVHzYkidCmkuIziKBZrcAVTop61M+HnlGk2OYFiRB/q07VCHkehg1MGQMGo3Ul0p1poYWosFQXApHhJp0uHfyClc2ib/NQ+1nHbSCOCBWeHQXxUGKc8V6oLvcg+baA6vmZA36UqYPrpda3K/RDT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49868	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	383	OUT	GET /psb/capla/static/media/world-map.7d457a5d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	620	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 7367 Connection: close Last-Modified: Fri, 12 Jan 2024 13:21:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: _WxqA.ykv2FAu2X.15o3wW2f_BE35Gt3 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 16:14:48 GMT ETag: "a2bdd966488047aaa17dcebc5238432b" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Z-EYFfqbHfGdOuA3f8RopH_riZ2pkeuh09T0RLDi_s5amyg1WnivzA== Age: 25293 Vary: Origin
2024-01-15 23:16:20 UTC	6396	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 08 00 00 01 54 08 03 00 00 00 76 86 34 40 00 00 00 6c 50 4c 54 45 00 00 00 f7 f7 f7 f4 f4 f4 f7 f7 f7 f7 f7 f7 f6 f6 f6 f7 f7 f7 f9 f9 f9 f8 f8 f8 ff ff ff fa fa fa f8 f8 f8 f9 f9 f9 f8 f8 f8 f8 f8 f8 f8 f8 f8 f9 f9 f9 f8 f8 f8 f9 f9 f9 f8 f8 f8 f5 f5 f5 f8 f8 f8 ef ef ef f9 f9 f9 f9 f9 f9 fa fa fa f6 f6 f6 f7 f7 f7 fa fa fa fa fa fa f8 f8 f8 f8 f8 f8 ff ff ff f7 f7 f7 f6 f6 f6 f6 f6 f6 47 7d 83 78 00 00 00 24 74 52 4e 53 00 20 30 40 60 70 80 9f af 10 8f bf 50 df ff ef cf 90 7f 70 50 cf 10 af ef 30 90 a0 5f 2f 6f 8f 1f c0 b0 d0 06 a3 39 c9 00 00 1b e6 49 44 41 54 78 01 ec db e7 62 e2 30 0c 07 70 c9 f2 52 14 c9 61 f5 f6 7a ff 97 64 86 a6 50 2e 81 b4 84 1b bf 2f 37 bb 82 87 fc 97 81 7f 01 3a f2 21 a6 Data Ascii: PNGIHDRTv4@lPLTEG}x$tRNS 0@`pPpP0_/o9IDATxb0pRazdP./7:!
2024-01-15 23:16:20 UTC	971	IN	Data Raw: 81 d3 aa c6 f2 79 39 64 9b 0d 35 34 49 67 35 63 98 60 bf aa 26 19 33 87 60 b4 c3 1e 71 4e e4 e5 60 4e 07 e8 95 0e 32 7f c4 4f b6 91 99 c3 4c b2 d9 9d 0d 7f 7e 0c f8 f1 c0 91 66 6b e9 b8 d7 ef 8e 48 9e fd 39 3c 12 4e 66 eb e6 fd 3f ad 8a 23 8f 04 5b 57 c3 51 bf 5f ba bf a6 ba c0 4d 48 b3 db 7c ee 5c 07 ad 94 99 ba 5c 8f 10 8a 72 70 13 fb 96 aa 0b f2 52 8b 10 9e 94 27 aa ba 7c 26 0f 4a c1 82 10 36 aa e5 0f f9 d0 e0 b6 fc 31 d7 10 2c 06 c5 51 5b 49 d7 97 cb 59 6d 4e 30 e8 99 92 dc 85 44 34 a3 29 7c 19 d5 f8 6c 4f cc d9 5d 4c 44 77 dc 88 9c 4b b0 56 1d 2b 87 09 4d 75 98 09 95 70 34 b6 ac 91 65 e2 96 39 61 2e 2c 2e 89 b1 99 2b 3f f5 2b 79 b4 c7 d1 78 f3 f1 49 6d 0f 27 e8 ab da 14 83 b9 58 51 a1 73 b2 9d 6c 63 26 b4 88 18 f7 b5 76 5a fb 58 4e e1 63 d8 8c 14 4b Data Ascii: y9d54Ig5c`&3`qN`N2OL~fkH9<Nf?#[WQ_MH\|\\rpR'\|&J61,Q[IYmN0D4)\|lO]LDwKV+Mup4e9a.,.+?+yxIm'XQslc&vZXNcK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49869	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	575	OUT	GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 374 Connection: close Last-Modified: Fri, 05 Jan 2024 12:40:12 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: F8cxBieWLiHcMc8YpKpLX2mc4Yq6smNI Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 18:15:40 GMT ETag: "d4cb397172a601054d15e416b713f8b5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 6-GEI_4vKLOfWxNOeAw8ZR559rkHbs5rTAuNqFkzc2LE84B7xoBgqw== Age: 18041 Vary: Origin
2024-01-15 23:16:20 UTC	374	IN	Data Raw: 2e 66 63 32 66 32 63 30 64 61 38 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 64 38 34 30 35 34 31 62 61 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 61 65 39 35 33 36 62 65 35 64 7b 6d 61 78 2d 77 69 64 74 68 3a 39 31 38 70 78 7d 2e 66 35 32 32 61 38 64 34 34 62 7b 70 61 64 64 69 6e 67 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 29 7d 2e 64 63 36 32 35 34 34 34 65 66 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 Data Ascii: .fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49870	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
2024-01-15 23:16:20 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Ukxg3naZ6RIMZfHmzISeYJ28SV5gPagG Server: AmazonS3 ETag: "2980ea90c3f4c27d77bffbd1527870a7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 4JcXMBXpWOuj4JVdQW5f1SXQI2PzxAiIiavFs0siXE8EuPLUwJP9BQ== Age: 79028 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49872	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:20 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1FYxBAlnpir4aMeZTk4ZcxEZA4fQWxaq Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ok0Vx8bScNH7eEm0WoQIy_epDBA-S9SoiSQvzMRVVcGX214fMfJTxA== Age: 68213 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49871	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:20 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HFw3ZCRRGpO5Si5sk_Tu_yxdqq5JBka Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 72ENblbecz9S_xLtgTMla9qs_Wyt40cups1zf1zxjxu6j0A9XTOuwg== Age: 68213 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49875	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2316 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	2316	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 63 53 61 68 32 6d 6c 50 41 41 41 41 3a 7a 4c 41 44 6c 4e 32 58 5a 74 67 4c 69 45 77 48 64 56 43 30 46 46 64 36 68 35 79 65 43 6e 6e 78 62 31 53 50 65 52 39 35 6e 6f 75 74 46 56 48 7a 59 6b 69 64 43 6d 6b 75 49 7a 69 4b 42 5a 72 63 41 56 54 6f 70 36 31 4d 2b 48 6e 6c 47 6b 32 4f 59 46 69 52 42 2f 71 30 37 56 43 48 6b 65 68 67 31 4d 47 51 4d 47 6f 33 55 6c 30 70 31 70 6f 59 57 6f 73 46 51 58 41 70 48 68 4a 70 30 75 48 66 79 43 6c 63 32 69 62 2f 4e 51 2b 31 6e 48 62 53 43 4f 43 42 57 65 48 51 58 78 55 47 4b 63 38 56 36 6f 4c 76 63 67 2b 62 61 41 36 76 6d 5a 41 33 36 55 71 59 50 72 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAcSah2mlPAAAA:zLADlN2XZtgLiEwHdVC0FFd6h5yeCnnxb1SPeR95noutFVHzYkidCmkuIziKBZrcAVTop61M+HnlGk2OYFiRB/q07VCHkehg1MGQMGo3Ul0p1poYWosFQXApHhJp0uHfyClc2ib/NQ+1nHbSCOCBWeHQXxUGKc8V6oLvcg+baA6vmZA36UqYPr
2024-01-15 23:16:20 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 948 Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc4-3e4c31e61526c66929f5c5e2 X-Cache: Miss from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Y_T45bwkbZfe_A4mM5OV0PWOeTQxORMcdDxUjZ-94gNfK3U3JJlRRQ==
2024-01-15 23:16:20 UTC	948	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 65 67 53 6a 62 66 4d 49 41 41 41 41 3a 42 7a 4b 79 39 52 43 57 6a 45 71 6a 35 44 51 57 51 71 66 64 6b 4c 4d 70 72 6a 71 67 5a 6c 54 37 4f 41 42 32 57 69 72 50 77 72 79 49 73 50 72 42 4f 45 72 6c 41 33 46 68 36 42 34 32 77 57 4f 65 77 64 4d 33 31 58 4e 2b 56 72 4a 4c 6b 57 36 4f 71 53 36 71 6d 45 63 4f 6d 34 74 75 59 47 4d 31 53 42 72 6b 67 41 46 2b 6b 48 37 36 4c 66 41 54 71 4b 5a 51 42 55 64 59 67 52 76 68 35 49 47 75 45 79 67 66 4a 55 77 37 63 4e 30 45 54 6a 58 65 33 6e 6a 34 77 55 30 32 67 4c 72 64 4b 42 44 62 50 51 75 4b 76 43 53 4c 6e 38 62 39 4d 4a 55 51 55 45 58 67 6d 30 48 4b 59 46 51 35 72 53 68 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAegSjbfMIAAAA:BzKy9RCWjEqj5DQWQqfdkLMprjqgZlT7OAB2WirPwryIsPrBOErlA3Fh6B42wWOewdM31XN+VrJLkW6OqS6qmEcOm4tuYGM1SBrkgAF+kH76LfATqKZQBUdYgRvh5IGuEygfJUw7cN0ETjXe3nj4wU02gLrdKBDbPQuKvCSLn8b9MJUQUEXgm0HKYFQ5rSh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49874	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:20 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-headers: x-booking-et-serialized-state access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b7f525be96cecf61bbec66a423b622b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: l0-07FziS4ov4dhWnbPOk8WVCqbPYKsJLZgLKVCJk3OoU72USJBNOA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49877	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	444	OUT	GET /xdata/images/city/600x600/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 23 Dec 2023 11:57:00 GMT ETag: "045e691b7a2e5cb1c4e8558e8ef4cc99fbf77f86" Content-Language: 79443 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: M-aw0cHswB4IsI0--A8BSgtIQ87xgDi2MQxt9FlosP1hmg-pJNbzXw== Age: 2027960
2024-01-15 23:16:20 UTC	15834	IN	Data Raw: 31 33 36 35 33 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 13653JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: aa 49 ab 99 b9 c9 4b 96 c6 5e a7 e1 5b 08 6d 56 37 8e 77 02 77 77 92 39 be 65 52 7d 0a 90 dc 63 a0 1c 8a e7 ae bc 29 79 09 df a6 5c 4a 5d db 2b 14 f1 79 6e 79 0d f2 11 f2 b1 e0 9c 02 1b d0 71 5d c5 96 99 33 e9 0d 0c 3a 9b 49 73 8c 35 c1 21 9c 03 e9 e9 c5 6a 41 10 b4 d3 52 1b 99 44 8b 1a 05 79 25 39 dc 3a 65 b3 eb 49 51 4d 5c 52 76 7c ad 6a 78 a5 ce ad 7d 25 d3 c4 d2 bc 4c 01 43 e6 21 0c 4f f1 67 b8 27 2d 93 ee 6a fe 98 f7 17 56 d6 f6 d3 42 b3 08 1e 50 ae e3 77 de 5d c0 2f fb 59 56 20 f5 ae e7 c5 9a 15 b6 ad a6 3e a5 6b b5 ae 20 e6 57 8c e4 c9 10 fb c3 d0 95 1c ff 00 c0 7d 85 71 16 f6 f7 37 37 16 f6 71 5b b4 cd 34 bb 23 44 c0 7d dc f2 41 fe 10 32 70 7a 02 7d 2b 2e 4d 54 50 a5 a6 ac 92 32 1c 0d 9c 82 78 e3 1f a0 ad 0f ec 2b e7 55 df e5 da 06 e8 d3 b6 0f e0 Data Ascii: IK^[mV7www9eR}c)y\J]+ynyq]3:Is5!jARDy%9:eIQM\Rv\|jx}%LC!Og'-jVBPw]/YV >k W}q77q[4#D}A2pz}+.MTP2x+U
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: d7 ae 7d 8d 60 e9 de 0c fe c8 d6 22 b9 b5 54 29 9c 3e 7b 0e d8 3e bf a0 ae a1 a5 d4 33 fb bb 4b 6c 7f b7 72 47 f2 43 53 46 6e 08 fd e4 71 29 ef b6 42 df fb 28 a8 9d 38 cd dd 95 1a 92 8a b1 3d 15 5a 54 be 60 7c 99 ed e3 3d b7 c2 cf fc 98 51 5a 10 63 b5 ac 6f d5 a5 1f 49 58 7f 5a 8f ec 11 67 ef cf ff 00 81 0f fe 35 6f 14 57 41 99 00 b5 89 7a 06 3f ef 39 3f cc d2 f9 31 63 fd 5a 7e 2a 0d 4b 8a 31 40 88 1a d2 dd be f4 11 1f aa 0a 67 d8 6d 41 c8 b6 87 fe fd 8a b5 8a 4c 50 04 4b 0c 69 f7 63 45 fa 28 14 fa 52 28 c5 30 39 2f 1b 2c 6b 06 9f 33 28 2c 2e 82 e4 8e 83 69 c9 fe 55 0f 83 77 5b 4b a9 d8 a3 86 f2 e5 df 1b 11 c1 07 8e 7f 21 f9 9a d9 f1 45 9a 5d 68 57 0c 57 2f 12 ef 53 80 48 00 f3 8c f7 c6 6b 17 c2 77 10 cb 75 73 31 52 0a c6 24 0d 8f e1 60 09 07 d7 9f e6 7f Data Ascii: }`"T)>{>3KlrGCSFnq)B(8=ZT`\|=QZcoIXZg5oWAz?9?1cZ~*K1@gmALPKicE(R(09/,k3(,.iUw[K!E]hWW/SHkwus1R$`
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: c7 b7 f5 f7 9d 0c 70 dd dc ea 21 c3 e6 17 24 67 04 6d 3e e3 d6 ba 6b 2b 08 ec a1 08 84 93 8e 49 ef 52 43 6c 91 07 ef b9 b7 7d 2a 7a e8 8d 34 a5 cc 79 ae 4d ab 09 df 3d e8 c5 23 3a a9 01 98 02 4e 07 bd 29 60 18 29 38 2d d0 7a d6 b7 24 31 46 29 71 46 28 01 31 46 29 7b 53 77 2e 71 b8 67 8e f4 5c 05 c5 25 3a 8c 50 03 68 c5 3b 14 94 08 4c 57 2d f1 12 e4 da f8 1f 50 d8 fb 64 94 2c 48 79 e7 73 00 47 1e d9 ae aa bc cf e3 25 f2 2e 93 61 a7 6d 56 69 65 69 88 39 e0 28 c7 41 ee fe dd 29 4d fb a5 45 5d 9e 3c 22 96 12 4b 5b 07 8d b9 f3 bc 90 79 f4 f9 8e 3f 3e 7a 54 cb 62 2d b2 d3 c9 24 6c a0 62 3c aa 92 7d 79 e9 f8 55 bd 3a ca ca e6 39 1a 59 65 b6 c0 e0 88 72 aa 41 c8 e4 fc a0 70 7b ff 00 3a 53 2a b8 30 fd 91 2e 52 35 04 c9 1c 0a a4 e3 fd a0 46 06 4f 41 eb de b8 24 f5 Data Ascii: p!$gm>k+IRCl}z4yM=#:N)`)8-z$1F)qF(1F){Sw.qg\%:Ph;LW-Pd,HysG%.amViei9(A)ME]<"K[y?>zTb-$lb<}yU:9YerAp{:S0.R5FOA$
2024-01-15 23:16:20 UTC	14466	IN	Data Raw: c7 e5 93 1b 4e b2 0d b8 1e dc 56 9c 3a 81 8c 84 9e 34 28 78 1b 63 5c 8f cb 15 ac 71 31 d9 a3 36 ae ce 45 af ae 23 f0 9d e2 c6 e7 c9 98 4a 19 55 73 b4 96 3e d8 c6 33 cf ff 00 ae a3 93 45 0e e2 e2 e6 71 04 53 44 82 17 61 95 c8 c6 73 c7 23 da ba 7b fb 2d 3f fe 11 db db 3d 3b cd 37 13 e4 af 9c 40 f9 89 e7 9e 9e a6 b5 74 5d 25 9e c0 24 ec 1b cb 45 5f dd 30 38 3c e7 3e dd 28 55 22 6a e0 e4 b4 38 49 6e 34 29 ac 60 13 c9 12 5d 46 1b a6 e0 54 92 49 ed 8c 73 9c 56 7e 9f 1c 32 78 9c fd 9a e4 bc 65 02 ef 63 9c f1 5e ab 26 80 8c bb 63 94 63 d1 d0 1f e5 8a f3 dd 5a d1 f4 9f 1c 22 23 c4 aa 61 0c cb 6e 3a f2 41 07 03 ae 01 fd 29 d4 71 71 7c ac 29 42 51 9f bc 8b 5f d8 d1 bc d2 8f b6 c2 a0 b4 8a 4e 72 79 27 b7 a8 f4 fa d2 5e 68 ce fa 15 87 95 75 03 c9 03 3a 1c 9c a9 5f bd Data Ascii: NV:4(xc\q16E#JUs>3EqSDas#{-?=;7@t]%$E_08<>(U"j8In4)`]FTIsV~2xec^&ccZ"#an:A)qq\|)BQ_Nry'^hu:_
2024-01-15 23:16:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49876	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT X-Cache: Error from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ZPtTWmD2VZTsPky12i8TfY89BoJbw9fnd1_okLr6y96K_swGM4TYag==
2024-01-15 23:16:20 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49880	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
2024-01-15 23:16:20 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XfMuq.rXaESBqMTX7ruwS5oLJVLV6ApO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: rr9KjN3kI9HQbMKd-mUD_CYRux7YZPHYvAyCBKmpNStBuvJPxKK67A== Age: 55142 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.5	49881	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "4066f4e0b6c463342177866cfb14bcfe" If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
2024-01-15 23:16:20 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnArrg..MyhLONitGPttToVO8CuhdWrQ Server: AmazonS3 ETag: "4066f4e0b6c463342177866cfb14bcfe" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vU9HW2z966sBSc2KyUZaELTnATmX8zWJeIhytH9PWnuTlC_8yLf1ew== Age: 68213 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.5	49863	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	676	OUT	GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1fe97ff079513bb667876c67c4aa952f" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:20 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:20 GMT ETag: "1fe97ff079513bb667876c67c4aa952f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: fCN4NuuMwamSymkc1hBoNY2dedXX15Np Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 0LW36hSDAcc2b76mQQDnprH_eurlv6860UgDVC5Z1dWCR-Yo6OuB0g== Age: 68213 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.5	49882	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	679	OUT	GET /xdata/images/city/600x600/976884.jpg?k=00a3546794e9e8cbb86b98371056949ee731002b76358467601e85a0b09dd6db&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 02 Jan 2024 13:55:05 GMT Content-Language: 58584 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "de2a3e99964d447c984a961f27a531cff5636112" X-Cache: Hit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: kiWSr2GEWeeLc-SpjahmdluyWnM2juk8v70H5WKYG91-kpPpygW-Ew== Age: 1156875
2024-01-15 23:16:20 UTC	15834	IN	Data Raw: 65 30 63 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: e0ceJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: 9f f6 96 ba 2f 11 5f 40 34 d9 2d 91 96 47 90 73 b5 81 db 8e 79 1c fa 56 b1 76 85 8c a4 bd f3 ce 7c 34 72 75 5f a0 ff 00 d9 aa 17 07 64 9b bd 07 f0 e2 a1 f0 e4 c4 6a 17 8a 3a 32 90 79 f6 6a b3 23 0f 29 8e 3b 76 ac 65 b9 aa d8 a3 08 3e 4a 72 c7 e6 e3 e4 1d 31 fe 79 a9 34 65 25 2f 40 52 49 89 b2 be 50 6c fe f0 76 3d 7e 95 1c 2d be 11 d0 91 8f f2 69 da 46 cd 97 e1 80 c1 85 c9 ce 7f e7 a8 f4 a4 05 94 49 b6 49 98 1d 46 c1 80 d6 71 a7 f1 2f f9 c5 07 1b a4 0c a5 48 89 4e e0 c8 9d c7 e5 51 c3 02 79 32 f9 23 e5 28 30 04 2c 4f 55 c7 5a b0 62 74 59 31 04 ad 98 94 71 64 a7 3c 8e 39 eb df 8a 60 5d d0 ce 75 04 d9 23 67 71 c7 99 74 ae a3 e5 6e ab e9 56 35 09 55 05 b6 eb 99 7e 64 c8 68 d7 ef 70 3d 70 45 45 a2 f9 a3 50 0a d6 ef b7 9f f5 96 ab 1a 9f 95 b8 dc 0f 4e 7d 46 2a Data Ascii: /_@4-GsyVv\|4ru_dj:2yj#);ve>Jr1y4e%/@RIPlv=~-iFIIFq/HNQy2#(0,OUZbtY1qd<9`]u#gqtnV5U~dhp=pEEPN}F*
2024-01-15 23:16:21 UTC	16384	IN	Data Raw: e6 d9 58 85 b6 4b 83 26 36 86 42 4a 1e 38 eb fe 73 f4 ab 12 bd b4 96 a5 23 56 46 46 4d b1 33 e7 6f cd cf 61 c6 4f f3 ac 06 99 e2 25 53 cc 42 7a 8e 99 ab d6 21 26 7b 68 e5 8e 70 33 b5 8e 73 bc e7 80 33 d3 ad 6e e2 80 d4 bb b9 08 55 0b 14 f9 71 14 a0 63 0e bd 73 91 c8 e4 8f a9 ae cb c1 da 95 fc a4 59 db 42 6e 61 69 15 e7 25 cf 96 99 04 92 01 1d ce 0f 4c 9c 72 46 79 c8 83 c2 52 eb 77 0a 6d e4 5b 6b 64 e5 9d 9b 79 40 18 63 1c f4 38 3d 7a 63 e9 5d 8e 81 e1 a9 74 7d 41 2e e7 d4 5e 56 da 37 b2 81 c9 f9 b3 c1 07 83 95 e8 41 e0 fa e6 92 b5 86 8d a9 b4 9b 19 49 67 b3 b7 6c fa c2 a7 f9 0a ad 27 87 74 d7 5f 96 ce dd 73 dc 28 07 f5 04 56 f8 9a 39 7a 3a 13 ee a0 13 4d 74 c1 e7 2a 28 71 4f 71 9c c4 9e 0f d3 dc a9 58 15 48 ea 58 67 3f 80 c5 28 f0 ca c0 00 b7 86 25 39 ce Data Ascii: XK&6BJ8s#VFFM3oaO%SBz!&{hp3s3nUqcsYBnai%LrFyRwm[kdy@c8=zc]t}A.^V7AIgl't_s(V9z:Mt*(qOqXHXg?(%9
2024-01-15 23:16:21 UTC	8956	IN	Data Raw: ba 8a 30 ab f4 1f e4 d4 05 c0 a8 da 4c 70 2a 3c 92 79 a0 64 8c e4 d0 17 34 8a b9 1c d3 f2 06 70 28 00 00 2d 31 e5 c0 fe b4 d6 7e 40 19 24 f0 00 a7 e0 40 72 e1 5e 7f ee 9e 56 3f af ab 7b 74 1d eb 39 d4 51 d3 a9 51 8d f5 e8 01 38 12 5c 64 03 ca c6 38 2d ee 7d 05 23 c8 ce 41 7c 70 30 00 18 03 d8 0e c2 9a d2 31 25 89 24 93 92 4f 24 d3 19 b0 09 27 00 54 c6 36 f7 a7 bf e4 36 ef a4 45 2f 80 49 6c 0f 7a c4 d7 f5 fb 6d 2e d3 7c 8e 18 b0 f9 21 1d 64 3f d0 0a ad e2 3f 11 db e9 16 9b 99 77 ce c3 f7 50 93 82 de e7 db fc fb 8f 2e 6d 42 7d 47 52 92 e6 f9 fc d7 27 bf 40 31 c0 03 d0 50 93 a9 e8 37 68 7a 96 67 96 eb 58 d4 cd f5 f3 fc 9c 16 ec 11 7b 00 3b 0f f3 f5 9c 4e b7 25 a2 80 95 81 31 f8 f5 ed 55 ee 63 92 55 8e de 13 81 9c c9 83 d7 df f9 57 7b e1 7f 0c 8b 08 a2 bd ba Data Ascii: 0Lp*<yd4p(-1~@$@r^V?{t9QQ8\d8-}#A\|p01%$O$'T66E/Ilzm.\|!d??wP.mB}GR'@1P7hzgX{;N%1UcUW{
2024-01-15 23:16:21 UTC	1041	IN	Data Raw: 34 30 61 0d 0a 9e d1 c4 cd e5 b3 b2 8c 84 52 32 7f 33 8a 7d bc cd 73 08 69 20 92 12 78 d9 26 dc 8f c8 91 fa d4 2c 99 38 e7 f3 e2 95 4f 3c 1c 11 d7 9a 00 b3 82 8d cf 4a 72 b0 07 23 a7 f2 a6 2b 6e 5c 31 3e d8 a3 05 78 2d f5 e2 80 27 ce 4e 45 07 27 18 3c 9a 89 08 4f 71 d8 fa 54 81 83 72 08 c9 a0 04 d8 58 63 04 a9 ed e9 45 28 24 b6 77 74 3d 08 eb 45 43 1f cc 39 27 fa 52 88 d8 a9 62 a7 03 d2 8a 29 d4 6d 46 e8 70 57 95 88 db cc 21 89 3b 50 73 92 47 03 de bc ef c4 fe 2c 17 04 e9 f6 2e fe 53 12 25 95 4f de c6 78 14 51 58 61 d7 34 b9 99 ad 79 38 ab 23 8b b8 60 32 30 42 a8 0d f8 e3 91 45 9c 7f 69 bc d8 aa db 0f dd 34 51 5d eb 63 90 e9 a1 b3 b6 36 49 73 32 4a 62 85 ca 2c 4b d6 66 ec a3 fa d7 67 a3 69 12 da 83 7b 7c 03 5e c8 36 84 04 6d 85 3b 20 f4 f7 fd 3d ca 2b 19 Data Ascii: 40aR23}si x&,8O<Jr#+n\1>x-'NE'<OqTrXcE($wt=EC9'Rb)mFpW!;PsG,.S%OxQXa4y8#`20BEi4Q]c6Is2Jb,Kfgi{\|^6m; =+
2024-01-15 23:16:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.5	49884	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	3150	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 497 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-AID: 304142 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAcSah2mlPAAAA:zLADlN2XZtgLiEwHdVC0FFd6h5yeCnnxb1SPeR95noutFVHzYkidCmkuIziKBZrcAVTop61M+HnlGk2OYFiRB/q07VCHkehg1MGQMGo3Ul0p1poYWosFQXApHhJp0uHfyClc2ib/NQ+1nHbSCOCBWeHQXxUGKc8V6oLvcg+baA6vmZA36UqYPrpda3K/RDTczjpYkbpPZuO5xkxg+BmiVwXCfckYjLZFhVx9zLwjKvt+1t5UHODgnm2y3RTOBaGHaxbVT3aW
2024-01-15 23:16:20 UTC	497	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 70 72 69 76 61 63 79 5f 63 6f 6e 73 65 6e 74 2e 63 6f 6f 6b 69 65 5f 63 6f 6e 73 65 6e 74 5f 6c 6f 61 64 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6c 6f 61 64 5f 64 75 72 61 74 69 6f 6e 22 3a 31 37 30 33 36 35 35 32 31 38 36 32 32 2c 22 64 69 73 70 6c 61 79 65 64 22 3a 66 61 6c 73 65 2c 22 6e 65 74 77 6f 72 6b 5f 69 6e 66 6f 72 6d 61 74 69 6f 6e 22 3a 7b 22 65 66 66 65 63 74 69 76 65 5f 74 79 70 65 22 3a 22 34 67 22 7d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: {"events":[{"action_name":"privacy_consent.cookie_consent_loaded","action_version":"1.0.0","content":{"load_duration":1703655218622,"displayed":false,"network_information":{"effective_type":"4g"}},"context":{"page":{"page_referrer":"","page_url":"https://
2024-01-15 23:16:21 UTC	1183	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 31 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:21 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBJuNNB3uW%2FTellQJznJTj4gLcWMuW7X%2FbaYDnj83rrVwdHW%2B5sJRDKGhisK92NyIT97EVH%2FDg6DGonqrBjp5W5YbCT%2FQ9u%2BupaHsmO6Kg5QngpBvoNnz6sQy1S2jENouiM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:21 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c94aa3a2ddfa0067&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstbueQSWZEQ4K-wPPnKY9prQULIxrr8Qn8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: AUvlEp2eMIdPlngVL7spr9PL8m6RSReiHbEEr3rvsoHZqxdkh99GQw==
2024-01-15 23:16:21 UTC	31	IN	Data Raw: 5b 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.5	49883	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	679	OUT	GET /xdata/images/city/600x600/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:20 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 30 Dec 2023 10:59:20 GMT ETag: "3f8267ebd0508c68e3d519428a7d00fe4c1a2f74" Content-Language: 65913 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: r1ZdHxJwCCflD20EaROujIHBFjAabcXIkfu6JW3NvCtJZFeLM4-jdA== Age: 1426620
2024-01-15 23:16:20 UTC	15834	IN	Data Raw: 31 30 31 37 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 10179JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"
2024-01-15 23:16:20 UTC	16384	IN	Data Raw: ff 00 af 5a 5e 11 c1 be 88 b1 c6 16 53 f9 94 14 3d 80 a5 72 db ef 98 f1 fe ae e9 ff 00 57 aa 97 52 3b c5 6f 1e c2 23 86 05 6f cf a9 3f 89 03 f0 15 2c 8d f3 96 3f f3 eb 29 fc d9 c7 f5 a6 cb f2 c3 75 cf 22 d2 00 3f 1d 86 93 57 04 ec 76 1f 0e ed c2 6a 30 cf 8c c8 ef 22 9c ff 00 08 0b 9c 7e b5 b9 f1 3f fe 45 eb 71 ff 00 4f 03 f9 1a ab e0 94 27 52 dd c7 cb 3c d9 fc 80 ab 5f 13 ce 34 2b 61 ff 00 4f 03 f9 1a 6b e1 13 77 91 7b fe 10 ad 0e ea e2 0b f6 b5 65 97 0a e4 23 95 52 d8 1c e0 7f 4a e9 02 85 01 54 00 00 c0 03 b5 32 d3 fe 3c e0 ff 00 ae 6b fc aa 53 5a 19 b1 29 0d 2d 25 02 12 90 d2 9a 69 a6 02 1a 43 4a 69 b4 08 43 4d a5 34 94 c0 4a 43 4a 69 b4 08 4a 43 4b 49 4c 06 d1 45 14 08 6d 25 38 d3 4d 00 21 a4 34 b4 86 80 10 d2 52 d2 53 01 a6 92 94 d2 53 40 21 a6 d3 8d Data Ascii: Z^S=rWR;o#o?,?)u"?Wvj0"~?EqO'R<_4+aOkw{e#RJT2<kSZ)-%iCJiCM4JCJiJCKILEm%8M!4RSS@!
2024-01-15 23:16:21 UTC	16384	IN	Data Raw: ab 2b 0c 1f ba 6b 85 56 ba 8c ee da af e8 41 35 19 b8 65 6c 49 01 0d c6 70 47 14 f9 c5 c8 76 97 96 16 77 b0 b2 5c 5b 47 22 b3 72 19 41 f5 c5 65 5f 78 4b 4e bc 5b ac 19 63 7b 87 56 91 95 b3 92 39 ef d3 ad 64 ae a7 22 29 51 3d cc 60 e3 a9 20 54 f1 6b f7 00 80 27 47 e0 1c 30 1c ff 00 2a 6a 62 70 1c de 15 29 a8 5c 4d f6 a0 44 cf 13 6d d9 d0 21 07 1d 7b e2 a3 f1 2f 86 6f 75 8d 45 2e ad e4 84 2a c0 f1 ed 91 88 39 3b bd 07 b8 ad 08 f5 f9 1a 3d ad 04 2e 7f bc a3 18 cf e7 4a 35 c4 cb 6e 89 c6 3b 2b 67 15 4a 64 b8 1c 64 9e 0c d6 2d a3 43 e5 c6 f8 b7 68 86 c9 06 72 49 f5 c7 ad 58 f1 4d 85 dc c6 43 1d b4 cc a2 d8 28 21 0f 5f 34 1f e4 33 5d 80 d4 a0 9f 68 32 32 6d e4 64 55 88 ae e0 7c 15 9a 36 c8 fe f5 5a 99 3c a7 98 6b fa 3d ce 95 24 91 cf e5 b7 9f 24 25 4a 36 46 30 Data Ascii: +kVA5elIpGvw\[G"rAe_xKN[c{V9d")Q=` Tk'G0jbp)\MDm!{/ouE.9;=.J5n;+gJdd-ChrIXMC(!_43]h22mdU\|6Z<k=$$%J6F0
2024-01-15 23:16:21 UTC	16384	IN	Data Raw: 6d a6 85 77 2c 7b 37 79 99 18 3c 77 c6 3f 5a e4 ab 27 bb 1a d4 a5 a8 43 24 10 c4 75 25 71 3a 63 03 69 1b 93 d4 1e 98 3e d5 9d 06 ab 15 b5 dc 6d 14 32 c7 3a b0 dc 4b f0 c3 e8 47 1d 6b b9 8d ae a4 8a 5b 56 b9 0e 92 63 2a a8 bb 17 b1 ff 00 77 f2 1f 8e 2b 9a 9f 4f 17 1a d9 81 62 fd da 47 f3 b3 20 de 73 c7 27 1c 1e 71 59 45 c6 45 f2 93 6a 4d 75 aa a4 72 28 c4 2f 23 0c 82 18 b3 01 9e 70 37 1c 0a b1 b7 4a 7b 6f 21 5e 27 24 2e 64 6d a5 87 1d 00 0d 81 83 d4 e4 1c d3 7c 45 a6 cd 65 14 36 f1 de 37 96 57 90 aa 15 9b 38 e8 06 38 1d 3f 0f 7a e5 2f 01 b4 b9 6b 29 63 07 c8 76 43 8e 33 cf 5f c6 a9 53 5d 05 b1 7f ec 96 b1 dc 98 43 6e 0c dc 12 db 32 3d 3a 1c 52 ea 30 25 8d ab 06 54 dc 92 60 0c e4 90 7a 10 78 c8 ac f6 9a 39 55 e3 64 18 03 8d 80 7e 98 e6 ab 6a 3a b3 df 59 25 Data Ascii: mw,{7y<w?Z'C$u%q:ci>m2:KGk[Vc*w+ObG s'qYEEjMur(/#p7J{o!^'$.dm\|Ee67W88?z/k)cvC3_S]Cn2=:R0%T`zx9Ud~j:Y%
2024-01-15 23:16:21 UTC	936	IN	Data Raw: e2 12 4f a1 7e 3f f1 da 6a d8 db b9 fd e5 d4 48 7d 72 ff 00 fc 4d 14 53 0b 2b 8a da 65 90 1c 5e c2 7e a5 cf fe c9 51 ad ac 51 10 d1 dd c4 1d 7e eb 29 60 47 e3 b6 8a 29 29 30 71 44 a6 e6 f4 2f cb a8 be 3d a7 7f f0 a5 f3 2f ca 86 fe d1 90 8f 5f b4 37 f8 51 45 55 d8 b9 51 0c b6 76 d3 4c 25 9d b7 cc 79 f3 1e 40 5b db 92 9f d6 a5 99 ee 76 ed 37 b7 25 18 60 86 b9 c8 23 e9 8a 28 a9 6d 95 ca bb 09 a7 43 15 aa dd bd ba 45 1b 08 78 75 54 0c bf 3a 77 00 53 26 d4 2f 6e 53 64 d7 0f 22 e7 38 79 15 87 eb 45 14 5d b2 94 52 7a 1b f6 1e 32 ba b6 89 92 ee 01 74 db b2 ac 66 45 c0 e3 8e 07 f9 cd 74 f6 7a fe 9b 79 e4 a2 5d 46 27 94 0c 45 9c 90 c4 74 a2 8a e1 af 87 83 5c d6 3d 0a 15 e7 7b 33 53 04 53 4e 08 c1 a2 8a f2 d9 e9 a2 27 b5 81 c6 1a 08 db ea a2 aa cb a4 e9 d2 8c 3d 8d Data Ascii: O~?jH}rMS+e^~QQ~)`G))0qD/=/_7QEUQvL%y@[v7%`#(mCExuT:wS&/nSd"8yE]Rz2tfEtzy]F'Et\={3SSN'=
2024-01-15 23:16:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.5	49865	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	559	OUT	GET /psb/capla/static/js/b9a82cb8.4f94b8d4.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:21 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 56671 Connection: close Last-Modified: Thu, 11 Jan 2024 12:44:23 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: HDoHq2FYdyloLN2.YMS49dygT6aSmf5n Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 14:46:53 GMT ETag: "1843f2502e83cfa4869676007b653c89" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: t6xKsyfzHBNeIylyNM9i1lOzdIgTai8-NOnoI3up8DB7-f1u4sUL6Q== Age: 30569 Vary: Origin
2024-01-15 23:16:21 UTC	15750	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 64 28 6e 2c 7b 42 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 74 3d 69 28 22 64 63 36 64 32 38 66 66 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 74 Data Ascii: "use strict";(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b9a82cb8"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t
2024-01-15 23:16:21 UTC	16384	IN	Data Raw: 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 61 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 4c 6f 67 69 6e 4c 61 6e 64 69 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c Data Ascii: ,name:{kind:"Name",value:"name"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"value"},arguments:[],directives:[]}]}}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"LoginLanding"}},directives:[],sel
2024-01-15 23:16:21 UTC	16384	IN	Data Raw: 61 74 69 74 75 64 65 22 2c 53 74 72 69 6e 67 28 6f 29 29 2c 45 2e 73 65 74 28 22 6c 6f 6e 67 69 74 75 64 65 22 2c 53 74 72 69 6e 67 28 63 29 29 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 75 29 7b 63 6f 6e 73 74 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 71 3f 57 3a 65 3d 3d 3d 58 3f 24 3a 76 6f 69 64 20 30 7d 28 70 61 72 73 65 49 6e 74 28 53 74 72 69 6e 67 28 75 29 2c 31 30 29 29 3b 65 26 26 45 2e 73 65 74 28 59 2c 65 29 7d 72 65 74 75 72 6e 20 67 26 26 45 2e 73 65 74 28 4b 2e 6d 54 2c 67 29 2c 6d 26 26 45 2e 73 65 74 28 22 6f 72 64 65 72 22 2c 6d 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 70 26 26 28 45 2e 73 65 74 28 22 67 72 6f 75 70 5f 61 64 75 6c 74 73 22 2c 53 74 Data Ascii: atitude",String(o)),E.set("longitude",String(c))),"undefined"!==typeof u){const e=function(e){return e===q?W:e===X?$:void 0}(parseInt(String(u),10));e&&E.set(Y,e)}return g&&E.set(K.mT,g),m&&E.set("order",m),"undefined"!==typeof p&&(E.set("group_adults",St
2024-01-15 23:16:21 UTC	8153	IN	Data Raw: 75 72 6e 20 65 2e 47 4c 4f 42 41 4c 5f 45 56 45 4e 54 3d 22 47 4c 4f 42 41 4c 5f 45 56 45 4e 54 22 2c 65 2e 52 45 47 49 4f 4e 41 4c 5f 45 56 45 4e 54 3d 22 52 45 47 49 4f 4e 41 4c 5f 45 56 45 4e 54 22 2c 65 7d 28 7b 7d 29 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 44 49 53 52 55 50 54 49 56 45 3d 22 44 49 53 52 55 50 54 49 56 45 22 2c 65 2e 4e 4f 52 4d 41 4c 3d 22 4e 4f 52 4d 41 4c 22 2c 65 7d 28 7b 7d 29 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 62 6f 6f 6b 69 6e 67 50 72 6f 63 65 73 73 3d 22 62 6f 6f 6b 69 6e 67 50 72 6f 63 65 73 73 22 2c 65 2e 6e 65 65 64 73 50 72 6f 66 69 6c 65 3d 22 6e 65 65 64 73 50 72 6f 66 69 6c 65 22 2c 65 2e 70 6f 70 75 6c 61 72 69 74 79 3d 22 70 6f 70 75 6c 61 72 69 74 Data Ascii: urn e.GLOBAL_EVENT="GLOBAL_EVENT",e.REGIONAL_EVENT="REGIONAL_EVENT",e}({}),a=function(e){return e.DISRUPTIVE="DISRUPTIVE",e.NORMAL="NORMAL",e}({}),r=function(e){return e.bookingProcess="bookingProcess",e.needsProfile="needsProfile",e.popularity="popularit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.5	49885	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:20 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:21 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:21 GMT X-Cache: Error from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: U9O8QZAN504-TT10F-Xj8Dc5_OTqvL569tGfMLVnS3MGIoexYcHpMw==
2024-01-15 23:16:21 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.5	49886	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:21 UTC	1583	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9oYvrLOmeNv%2BeeiLOioceIZ9hEc%2Fww3bxdl8hObF1FDi3jcc1geYiPIKZzxvvG1BCPZY1ulH%2Frgy0niOL5Mtku3bSeoOT0YTEjrBs7pW246qlJc9eVQLe3siYinpVPGjGPwppE%2FR3q6oudL%2FNCXAH7lbIMqDYCEJM%3D
2024-01-15 23:16:21 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:21 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5d4199dbed922d7847172f5631f32dbc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: 6Sk47uzB05L0x2-QW5YXBs2JfO8cFfK3XY3nzb0hn7lWRiFfnx6sXA==
2024-01-15 23:16:21 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.5	49887	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:21 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2386 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:21 UTC	2386	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 65 67 53 6a 62 66 4d 49 41 41 41 41 3a 42 7a 4b 79 39 52 43 57 6a 45 71 6a 35 44 51 57 51 71 66 64 6b 4c 4d 70 72 6a 71 67 5a 6c 54 37 4f 41 42 32 57 69 72 50 77 72 79 49 73 50 72 42 4f 45 72 6c 41 33 46 68 36 42 34 32 77 57 4f 65 77 64 4d 33 31 58 4e 2b 56 72 4a 4c 6b 57 36 4f 71 53 36 71 6d 45 63 4f 6d 34 74 75 59 47 4d 31 53 42 72 6b 67 41 46 2b 6b 48 37 36 4c 66 41 54 71 4b 5a 51 42 55 64 59 67 52 76 68 35 49 47 75 45 79 67 66 4a 55 77 37 63 4e 30 45 54 6a 58 65 33 6e 6a 34 77 55 30 32 67 4c 72 64 4b 42 44 62 50 51 75 4b 76 43 53 4c 6e 38 62 39 4d 4a 55 51 55 45 58 67 6d 30 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAegSjbfMIAAAA:BzKy9RCWjEqj5DQWQqfdkLMprjqgZlT7OAB2WirPwryIsPrBOErlA3Fh6B42wWOewdM31XN+VrJLkW6OqS6qmEcOm4tuYGM1SBrkgAF+kH76LfATqKZQBUdYgRvh5IGuEygfJUw7cN0ETjXe3nj4wU02gLrdKBDbPQuKvCSLn8b9MJUQUEXgm0
2024-01-15 23:16:21 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1036 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:21 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc5-759d397750c99d9b447288aa X-Cache: Miss from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cLK02tauiswCujUuSyfiLT2XS2DQxUyIonBsA5V5JWe9DZ2o2_UKnA==
2024-01-15 23:16:21 UTC	1036	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 59 57 47 69 38 56 49 63 41 41 41 41 3a 4f 79 35 49 34 38 33 72 37 79 46 67 76 76 31 37 6b 33 35 34 69 50 4c 59 56 32 76 64 2f 5a 6e 75 42 44 7a 44 4b 67 4a 79 31 44 4c 47 36 54 2b 4b 54 74 61 54 67 52 41 43 74 50 51 36 4d 41 76 67 30 33 44 62 68 69 41 6c 53 53 46 49 61 42 66 72 30 45 31 36 45 4f 70 76 38 72 63 38 57 4c 53 5a 30 66 4d 78 4e 42 30 68 49 58 46 35 39 62 54 63 5a 4a 73 2b 6a 37 35 31 64 56 4d 64 2b 52 7a 46 31 69 4c 30 68 59 69 79 32 66 51 79 2f 70 77 61 4e 58 66 78 42 76 55 31 6e 70 70 45 7a 4d 74 4d 36 58 38 35 4b 6e 36 67 47 30 2f 62 38 75 78 73 6a 6e 4f 68 71 63 68 30 38 6e 74 2b 36 38 66 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.5	49888	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	3157	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-AID: 304142 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAegSjbfMIAAAA:BzKy9RCWjEqj5DQWQqfdkLMprjqgZlT7OAB2WirPwryIsPrBOErlA3Fh6B42wWOewdM31XN+VrJLkW6OqS6qmEcOm4tuYGM1SBrkgAF+kH76LfATqKZQBUdYgRvh5IGuEygfJUw7cN0ETjXe3nj4wU02gLrdKBDbPQuKvCSLn8b9MJUQUEXgm0HKYFQ5rShV0KGtB2K65iaSl9YflOZSNedvru5vb6yPd0cXGpBExBxWpXtirFuzZ7PF+BYscBS8BmpFVofR; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBJuNNB3uW%2FTellQJznJTj4gLcWMuW7X%2FbaYDnj83rrVwdHW%2B5sJRDKGhisK92NyIT97EVH%2FDg6DGonqrBjp5W5YbCT%2FQ9u%2BupaHsmO6Kg5QngpBvoNnz6sQy1S2jENouiM%3D
2024-01-15 23:16:22 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 36 25 32 43 33 34 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 31 25 32 43 35 25 32 43 32 37 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 31 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=6%2C34%2C2%2C9%2C7%2C1%2C5%2C27%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=1&has_open_bookings=
2024-01-15 23:16:22 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:22 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qNF0ZHmS5p9m4Xj6FY62OGjd%2Fl1%2Bx3krnHYGmNV5rUA38ew7Rw7xrGki0gdFw5Ifmwow377oSKjqpT0UJOPqG59oJvemtx4oVFtxuY5mK12JgIqB%2BgANSYJ5%2BLh6aNFMLKpO8JtzsixiNYkDBrlwpKo%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:22 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8a29a3a3a53000ba&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_veP1T2GFQRfv6LuI0kkafFNzPE6fnj0qSs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: UEN6dAPLF0Af1GgpyOsuRm91spQX82YsaD78FHEIVBWEBOS_dg3ctw==
2024-01-15 23:16:22 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.5	49891	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2497 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	2497	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 59 57 47 69 38 56 49 63 41 41 41 41 3a 4f 79 35 49 34 38 33 72 37 79 46 67 76 76 31 37 6b 33 35 34 69 50 4c 59 56 32 76 64 2f 5a 6e 75 42 44 7a 44 4b 67 4a 79 31 44 4c 47 36 54 2b 4b 54 74 61 54 67 52 41 43 74 50 51 36 4d 41 76 67 30 33 44 62 68 69 41 6c 53 53 46 49 61 42 66 72 30 45 31 36 45 4f 70 76 38 72 63 38 57 4c 53 5a 30 66 4d 78 4e 42 30 68 49 58 46 35 39 62 54 63 5a 4a 73 2b 6a 37 35 31 64 56 4d 64 2b 52 7a 46 31 69 4c 30 68 59 69 79 32 66 51 79 2f 70 77 61 4e 58 66 78 42 76 55 31 6e 70 70 45 7a 4d 74 4d 36 58 38 35 4b 6e 36 67 47 30 2f 62 38 75 78 73 6a 6e 4f 68 71 63 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqc
2024-01-15 23:16:22 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1124 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:22 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc6-412a55f436d7d5e32e638cf8 X-Cache: Miss from cloudfront Via: 1.1 ead5a4c5fbab9ab09302c9bd4c52b4b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 6Ctd5oCmeuvWYQYHXKZwjpDTHfW55s7wBKg8vNphcmUhn6g3GfIAiA==
2024-01-15 23:16:22 UTC	1124	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 64 33 69 69 67 56 41 76 41 41 41 41 3a 42 6a 6a 65 57 6b 4b 54 78 59 6e 52 79 2f 65 32 32 44 73 38 66 2f 69 77 5a 57 69 57 70 75 47 33 7a 75 70 4f 31 77 74 52 5a 6b 71 44 53 74 63 6c 78 4f 53 4f 5a 33 49 32 31 55 36 61 66 6c 76 6a 63 45 44 61 42 4b 46 39 49 46 35 36 61 41 6b 43 6a 54 6f 45 69 68 41 78 4b 73 49 4b 34 70 6f 65 39 56 37 56 30 2f 42 4b 30 33 6b 42 49 44 34 58 69 45 68 4f 30 4d 44 37 75 78 71 68 56 6b 66 59 32 46 45 33 43 64 6e 6f 75 6a 42 31 43 45 31 6f 6c 57 33 35 39 2b 43 44 33 57 2f 53 50 43 47 68 43 4f 66 61 55 75 31 49 35 5a 4a 76 76 79 75 69 68 52 53 58 44 4a 65 41 30 70 35 32 6b 79 6a Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.5	49889	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	2646	OUT	POST /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&etgwv=js_onload_resource_transfer_size\|4272&_=1705360581704 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBJuNNB3uW%2FTellQJznJTj4gLcWMuW7X%2FbaYDnj83rrVwdHW%2B5sJRDKGhisK92NyIT97EVH%2FDg6DGonqrBjp5W5YbCT%2FQ9u%2BupaHsmO6Kg5QngpBvoNnz6sQy1S2jENouiM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0
2024-01-15 23:16:22 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:22 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=72b2a3a3e9620060&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLl0DCnc5l7TUN0AH7ieJoqrPqr8SDwJqs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 148f45d892bd2198be5295012ed59888.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: rKTeEQr9-Ed7unIpQ_Tqy8JLxWcsbAQPT1mtgCWzySy0d15LPv4KWg==
2024-01-15 23:16:22 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.5	49890	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	2648	OUT	POST /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&etgwv=js_onload_resource_transfer_size%7C4272&_=1705360581708 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBJuNNB3uW%2FTellQJznJTj4gLcWMuW7X%2FbaYDnj83rrVwdHW%2B5sJRDKGhisK92NyIT97EVH%2FDg6DGonqrBjp5W5YbCT%2FQ9u%2BupaHsmO6Kg5QngpBvoNnz6sQy1S2jENouiM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0
2024-01-15 23:16:22 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:22 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=50eba3a3868e002b&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJLBHzhPK4Y-TnRyi0m2SHUI-ZFU2T32eY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: p5lKPmdl69tacEkmZK5KN8hZ35QZyE_7iYqRDugK3mTBIfLGRoUplw==
2024-01-15 23:16:22 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.5	49894	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	636	OUT	GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Sun, 24 Dec 2023 15:54:43 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT ETag: "6419ae08-4ad" Expires: Tue, 23 Jan 2024 15:54:43 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: sKu64lejD9GtMDsYJuLZ9T0L7Rku0LnMaHU3vfLJJJluMpKcmkzxhw== Age: 1927299
2024-01-15 23:16:22 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.5	49893	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	588	OUT	GET /static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	793	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5036 Connection: close Server: nginx Date: Tue, 26 Dec 2023 13:36:06 GMT Last-Modified: Wed, 10 Apr 2019 11:21:34 GMT ETag: "5cadd1be-13ac" Expires: Thu, 25 Jan 2024 13:36:06 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: HC7kv45QSBkauB9vjk_IHdRmPjppvxqWRp98aimL2A-rbfrVnrAqxA== Age: 1762816
2024-01-15 23:16:22 UTC	5036	IN	Data Raw: 2e 6c 6f 67 6f 6c 69 6e 6b 2c 23 62 61 6e 6e 65 72 5f 74 65 78 74 2c 23 74 61 67 6c 69 6e 65 2c 23 62 32 35 6e 65 77 4e 61 6d 65 2c 23 74 61 62 73 2c 2e 68 65 6c 70 2c 2e 68 65 6c 70 53 6d 61 6c 6c 2c 2e 62 72 6f 77 73 65 2c 2e 62 75 74 2c 23 6d 6f 72 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 2c 23 72 73 73 46 6f 72 6d 49 6e 63 2c 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 6e 6f 50 72 69 6e 74 2c 2e 70 6f 70 75 70 2c 2e 63 61 6c 65 6e 64 65 72 2c 2e 73 65 61 72 63 68 20 68 34 2c 23 73 6f 72 74 41 6e 64 44 65 73 74 2c 62 75 74 74 6f 6e 2c 2e 73 63 6f 72 65 42 61 72 49 6d 67 2c 2e 70 72 65 76 6e 65 78 74 62 61 72 2c 64 69 76 2e 74 6f 70 2c 2e 68 6f 74 65 6c 6e 61 76 32 2c 2e 73 6d 61 6c 6c 49 6d 67 41 72 65 61 20 70 2c 2e 63 75 72 43 6f 6e 76 2c 23 63 75 72 72 Data Ascii: .logolink,#banner_text,#tagline,#b25newName,#tabs,.help,.helpSmall,.browse,.but,#moreDestinations,#rssFormInc,.placeholder,.noPrint,.popup,.calender,.search h4,#sortAndDest,button,.scoreBarImg,.prevnextbar,div.top,.hotelnav2,.smallImgArea p,.curConv,#curr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.5	49897	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	753	OUT	GET /static/css/searchresults_cloudfront_sd.iq_ltr/a1d6f1ae66ba2355300f85f32baadeeae31a7131.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 360202 Connection: close Server: nginx Date: Mon, 08 Jan 2024 06:52:19 GMT Last-Modified: Fri, 05 Jan 2024 06:00:00 GMT ETag: "65979ae0-57f0a" Expires: Wed, 07 Feb 2024 06:52:19 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ELL6-MmscAezGGRIQhusVfbkku69wmvMOeuuca5MJiRzlopNhUUnpg== Age: 663842
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 2e 68 6f 74 65 6c 6c 69 73 74 7b 63 6c 65 61 72 3a 6c 65 66 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 69 6e 6e 65 72 7b 6d 69 6e 2d 77 69 64 74 68 3a 39 38 30 70 78 7d 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2e 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 2d 66 75 6c 6c 2d 77 69 64 74 68 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 2e 74 5f 6d 5f 76 69 65 77 70 6f 72 74 20 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 69 6e 6e 65 72 7b 6d 69 6e 2d 77 69 64 74 68 3a 69 6e 68 65 72 69 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6f 72 65 5f 72 6f 6f 6d 73 5f 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 38 25 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 21 69 6d 70 6f 72 74 61 Data Ascii: .hotellist{clear:left;position:relative}#bodyconstraint-inner{min-width:980px}#bodyconstraint.bodyconstraint--full-width{max-width:none}.t_m_viewport #bodyconstraint-inner{min-width:inherit!important}.more_rooms_link{font-size:88%;font-weight:bold!importa
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 63 66 66 7d 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 3e 69 2e 62 2d 73 70 72 69 74 65 2c 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 3e 2e 62 75 69 5f 5f 64 6f 77 6e 5f 6f 72 61 6e 67 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 6e 6f 4a 53 20 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 3e 69 2e 62 2d 73 70 72 69 74 65 2c 2e 6e 6f 4a 53 20 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 3e 2e 62 75 69 5f 5f 64 6f 77 6e 5f 6f 72 61 Data Ascii: n:hover{background-color:#fafcff}#sort_by .sort_option>i.b-sprite,#sort_by .sort_option>.bui__down_orange{display:inline-block;margin:0;position:static;vertical-align:middle}.noJS #sort_by .sort_option>i.b-sprite,.noJS #sort_by .sort_option>.bui__down_ora
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 6c 6c 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 6d 61 72 67 69 6e 3a 30 20 30 20 38 70 78 20 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 6f 74 65 6c 6c 69 73 74 2e 73 72 5f 64 6f 75 62 6c 65 5f 73 65 61 72 63 68 20 2e 73 72 2d 62 61 64 67 65 73 5f 5f 72 6f 77 7b 6d 61 Data Ascii: ll_1_font-size);font-weight:var(--bui_font_small_1_font-weight);line-height:var(--bui_font_small_1_line-height);font-family:var(--bui_font_small_1_font-family);word-break:break-word;margin:0 0 8px 0!important}.hotellist.sr_double_search .sr-badges__row{ma
2024-01-15 23:16:22 UTC	16331	IN	Data Raw: 30 2c 30 2c 30 2c 30 2e 33 29 2c 69 6e 73 65 74 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 69 6e 73 65 74 20 30 20 2d 31 70 78 20 30 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 33 29 2c 69 6e 73 65 74 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 29 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 70 61 64 64 69 6e 67 3a 37 70 78 20 31 32 70 78 20 38 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 30 20 72 67 62 Data Ascii: 0,0,0,0.3),inset 0 1px 0 rgba(255,255,255,0.7);box-shadow:inset 0 -1px 0 rgba(0,0,0,0.3),inset 0 1px 0 rgba(255,255,255,0.7);cursor:pointer;display:inline-block;font-size:13px;font-weight:bold;padding:7px 12px 8px;position:relative;text-shadow:0 1px 0 rgb
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 72 6f 6d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 34 34 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 34 34 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 33 35 38 30 7d 35 30 25 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 39 70 78 20 23 30 30 37 31 63 32 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 39 70 78 20 23 30 30 37 31 63 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 31 63 32 7d 74 6f 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 34 34 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 34 34 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 Data Ascii: rom{-webkit-box-shadow:0 0 3px #444;box-shadow:0 0 3px #444;background-color:#003580}50%{-webkit-box-shadow:0 0 9px #0071c2;box-shadow:0 0 9px #0071c2;background-color:#0071c2}to{-webkit-box-shadow:0 0 3px #444;box-shadow:0 0 3px #444;background-color:#00
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 68 3a 30 3b 68 65 69 67 68 74 3a 30 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 38 70 78 20 38 70 78 20 30 20 38 70 78 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 62 61 64 34 66 37 20 74 72 61 6e 73 70 61 72 65 6e 74 20 74 72 61 6e 73 70 61 72 65 6e 74 20 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 72 6f 6f 6d 72 6f 77 2e 65 6e 74 69 72 65 5f 72 6f 77 5f 63 6c 69 63 6b 61 62 6c 65 20 61 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 72 6f 6f 6d 50 72 69 63 65 5f 66 6c 65 78 20 73 70 61 6e 2e 73 74 72 69 6b 65 2d 69 74 2d 72 65 64 5f 61 6e 69 6d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 72 6f 6f 6d 50 72 69 63 65 5f 66 6c 65 78 20 2e 61 6e 69 6d 61 74 65 64 Data Ascii: h:0;height:0;border-style:solid;border-width:8px 8px 0 8px;border-color:#bad4f7 transparent transparent transparent}.roomrow.entire_row_clickable a{text-decoration:none}.roomPrice_flex span.strike-it-red_anim{text-decoration:none}.roomPrice_flex .animated
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 2e 38 35 29 20 30 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 29 20 31 30 30 25 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 77 65 62 6b 69 74 2d 67 72 61 64 69 65 6e 74 28 6c 69 6e 65 61 72 2c 6c 65 66 74 20 74 6f 70 2c 6c 65 66 74 20 62 6f 74 74 6f 6d 2c 66 72 6f 6d 28 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 2e 38 35 29 29 2c 74 6f 28 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 29 29 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 2e 38 35 29 20 30 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 29 20 31 30 30 25 29 3b 66 69 6c 74 65 72 3a 70 72 6f 67 69 64 Data Ascii: ear-gradient(top,rgba(0,27,65,0.85) 0,rgba(0,27,65,0) 100%);background:-webkit-gradient(linear,left top,left bottom,from(rgba(0,27,65,0.85)),to(rgba(0,27,65,0)));background:linear-gradient(to bottom,rgba(0,27,65,0.85) 0,rgba(0,27,65,0) 100%);filter:progid
2024-01-15 23:16:22 UTC	16331	IN	Data Raw: 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 67 63 2d 66 69 6c 74 65 72 5f 5f 70 6f 70 75 70 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 6c 65 66 74 3a 2d 77 65 62 6b 69 74 2d 63 61 6c 63 28 35 30 25 20 2b 20 31 31 38 70 78 29 3b 6c 65 66 74 3a 63 61 6c 63 28 35 30 25 20 2b 20 31 31 38 70 78 29 3b 62 6f 74 74 6f 6d 3a 2d 32 30 70 78 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 34 35 30 70 78 3b 62 6f 72 64 65 72 3a 30 3b 62 6f Data Ascii: gn:center;align-items:center}.gc-filter__popup{position:fixed;left:-webkit-calc(50% + 118px);left:calc(50% + 118px);bottom:-20px;pointer-events:none;opacity:0;-webkit-transition:.3s ease;transition:.3s ease;z-index:1;width:100%;max-width:450px;border:0;bo
2024-01-15 23:16:22 UTC	2898	IN	Data Raw: 61 64 67 65 2d 62 6f 78 20 2e 67 65 6e 69 75 73 2d 62 61 64 67 65 7b 68 65 69 67 68 74 3a 32 32 70 78 7d 2e 63 2d 65 61 72 6e 2d 63 72 65 64 69 74 73 5f 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 63 2d 65 61 72 6e 2d 63 72 65 64 69 74 73 5f 73 70 61 63 65 5f 62 6f 74 74 6f 6d 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 63 2d 65 61 72 6e 2d 63 72 65 64 69 74 73 5f 73 70 61 63 65 5f 74 6f 70 5f 61 6e 64 5f 62 6f 74 74 6f 6d 7b 70 61 64 64 69 6e 67 3a 34 70 78 20 30 7d 2e 63 2d 65 61 72 6e 2d 63 72 65 64 69 74 73 5f 72 65 73 65 72 76 61 74 69 6f 6e 5f 63 6f 6c 75 6d 6e 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 63 2d 65 61 72 6e 2d 63 72 65 64 69 74 73 5f 69 6e 6c 69 6e 65 7b 64 69 73 70 6c 61 79 Data Ascii: adge-box .genius-badge{height:22px}.c-earn-credits_right{text-align:right}.c-earn-credits_space_bottom{margin-bottom:8px}.c-earn-credits_space_top_and_bottom{padding:4px 0}.c-earn-credits_reservation_column{margin-bottom:8px}.c-earn-credits_inline{display
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 77 5f 70 65 72 63 65 6e 74 5f 63 6f 6e 74 61 69 6e 65 72 20 2e 6c 61 72 67 65 5f 73 74 61 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 32 35 33 2c 31 38 36 2c 31 2c 30 2e 32 35 29 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 2e 61 76 2d 69 6e 2d 73 69 64 65 62 61 72 20 23 6d 73 67 5f 6c 6f 77 5f 61 76 61 69 6c 20 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 61 76 2d 69 6e 2d 73 69 64 65 62 61 72 20 23 6d 73 67 5f 6c 6f 77 5f 61 76 61 69 6c 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 7d 2e 61 76 2d 69 6e 2d 73 69 64 65 62 61 72 20 23 6d 73 67 5f 6c 6f 77 5f 61 76 61 69 6c 20 2e 73 72 5f Data Ascii: w_percent_container .large_stat{padding-bottom:10px;border-bottom:1px solid rgba(253,186,1,0.25);margin-bottom:10px}.av-in-sidebar #msg_low_avail h4{font-size:13px!important}.av-in-sidebar #msg_low_avail p{font-size:13px}.av-in-sidebar #msg_low_avail .sr_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.5	49896	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	744	OUT	GET /static/js/searchresults_cloudfront_sd/900b3ff8dac9efe90aa71448ed3ad5600b5ab5b1.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 196066 Connection: close Server: nginx Date: Wed, 10 Jan 2024 13:45:52 GMT Last-Modified: Wed, 10 Jan 2024 11:45:34 GMT ETag: "659e835e-2fde2" Expires: Fri, 09 Feb 2024 13:45:52 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: tXMz9qA_cLR8V8lpf2U1DJ0Kn8dkK-roQ1gRtmC3RSEAJz96yhCvAA== Age: 466229
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 73 65 61 72 63 68 72 65 73 75 6c 74 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 2f 64 69 73 6d 69 73 73 69 62 6c 65 2d 69 74 65 6d 2f 62 6c 6f 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 5f 69 5f 28 22 63 62 39 3a 31 64 36 65 33 38 66 30 22 29 3b 76 61 72 20 6e 3d 65 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchresults={loaded:!0,run:!1}),B.define("component/dismissible-item/block",function(e,t,i){_i_("cb9:1d6e38f0");var n=e
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 2e 61 75 74 6f 43 6c 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 63 35 64 62 61 31 64 38 22 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 31 63 34 31 64 38 35 66 22 29 2c 24 65 6c 2e 66 61 64 65 4f 75 74 28 32 30 30 29 2c 5f 72 5f 28 29 7d 2c 33 65 33 29 2c 5f 72 5f 28 29 7d 2c 65 2e 72 65 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 39 61 30 35 32 31 62 36 22 29 2c 74 68 69 73 2e 75 70 64 61 74 65 4d 6f 64 65 6c 28 74 68 69 73 2e 63 75 72 72 65 6e 74 56 69 65 77 2c 21 30 29 2c 5f 72 5f 28 29 7d 2c 65 2e 63 6c 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 65 37 31 39 39 32 38 34 22 29 2c 74 68 69 73 2e 24 65 6c 2e 68 69 64 Data Ascii: .autoClose=function(){_i_("cb9:c5dba1d8"),setTimeout(function(){_i_("cb9:1c41d85f"),$el.fadeOut(200),_r_()},3e3),_r_()},e.reset=function(){_i_("cb9:9a0521b6"),this.updateModel(this.currentView,!0),_r_()},e.close=function(){_i_("cb9:e7199284"),this.$el.hid
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 69 66 28 5f 69 5f 28 22 63 62 39 3a 31 66 37 35 34 64 66 30 22 29 2c 69 26 26 4f 28 29 29 7b 6e 2e 66 6f 63 75 73 28 29 3b 76 61 72 20 65 3d 69 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 5b 68 72 65 66 5d 2c 20 62 75 74 74 6f 6e 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 2c 20 69 6e 70 75 74 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 2c 20 73 65 6c 65 63 74 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 2c 20 5b 72 6f 6c 65 3d 62 75 74 74 6f 6e 5d 22 29 3b 30 3c 65 2e 6c 65 6e 67 74 68 26 26 28 74 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 29 7d 5f 72 5f 28 29 7d 29 2c 61 2e 6f 6e 28 22 73 72 2d 61 74 6c 61 73 2d 63 6c 6f 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 5f 69 5f 28 22 63 62 39 3a 31 36 30 31 37 35 37 32 22 Data Ascii: if(_i_("cb9:1f754df0"),i&&O()){n.focus();var e=i.querySelectorAll("a[href], button:not([disabled]), input:not([disabled]), select:not([disabled]), [role=button]");0<e.length&&(t=e[e.length-1])}_r_()}),a.on("sr-atlas-close",function(){if(_i_("cb9:16017572"
2024-01-15 23:16:22 UTC	14808	IN	Data Raw: 5d 29 29 26 26 6f 2e 4d 4a 28 6f 2e 4d 42 28 62 5b 33 36 5d 29 3c 33 29 26 26 28 69 2b 3d 66 5b 35 36 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 72 65 76 69 65 77 5f 73 63 6f 72 65 5f 77 6f 72 64 5f 63 6f 70 79 22 2c 6f 2e 4d 42 28 62 5b 33 38 5d 29 29 2c 69 2b 3d 66 5b 35 37 5d 29 2c 69 2b 3d 66 5b 35 34 5d 2c 6f 2e 4d 4a 28 33 3c 3d 6f 2e 4d 42 28 62 5b 33 36 5d 29 29 26 26 6f 2e 4d 4a 28 6f 2e 4d 42 28 62 5b 33 36 5d 29 3c 34 29 26 26 28 69 2b 3d 66 5b 35 36 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 72 65 76 69 65 77 5f 73 63 6f 72 65 5f 77 6f 72 64 5f 63 6f 70 79 22 2c 6f 2e 4d 42 28 62 5b 33 39 5d 29 29 2c 69 2b 3d 66 5b 35 38 5d 29 2c 69 2b 3d 66 5b 35 34 5d 2c 6f 2e 4d 4a 28 34 3c 3d 6f 2e 4d 42 28 62 5b 33 36 5d 29 29 26 26 6f 2e 4d 4a 28 6f 2e 4d 42 28 62 5b 33 36 Data Ascii: ]))&&o.MJ(o.MB(b[36])<3)&&(i+=f[56],o.MN("fe_review_score_word_copy",o.MB(b[38])),i+=f[57]),i+=f[54],o.MJ(3<=o.MB(b[36]))&&o.MJ(o.MB(b[36])<4)&&(i+=f[56],o.MN("fe_review_score_word_copy",o.MB(b[39])),i+=f[58]),i+=f[54],o.MJ(4<=o.MB(b[36]))&&o.MJ(o.MB(b[36
2024-01-15 23:16:22 UTC	269	IN	Data Raw: 61 67 65 5f 73 72 63 22 2c 22 22 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 69 6d 61 67 65 5f 61 6c 74 22 2c 22 22 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 70 68 6f 74 6f 73 22 2c 22 22 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 69 63 6f 6e 5f 6e 61 6d 65 22 2c 22 22 29 2c 65 2b 3d 66 5b 38 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 62 65 61 63 68 5f 72 65 76 69 65 77 22 2c 22 22 29 2c 65 2b 3d 66 5b 39 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 64 61 74 61 5f 61 72 67 73 22 2c 22 22 29 2c 65 2b 3d 66 5b 32 5d 3b 65 6c 73 65 7b 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 63 6c 61 73 73 22 2c 22 62 65 61 63 68 2d 62 65 61 63 68 2d 63 61 72 64 22 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 62 65 61 63 68 5f 69 64 Data Ascii: age_src",""),e+=f[0],o.MN("fe_image_alt",""),e+=f[0],o.MN("fe_photos",""),e+=f[0],o.MN("fe_icon_name",""),e+=f[8],o.MN("fe_beach_review",""),e+=f[9],o.MN("fe_data_args",""),e+=f[2];else{e+=f[0],o.MN("fe_class","beach-beach-card"),e+=f[0],o.MN("fe_beach_id
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 5b 31 5d 29 7c 7c 7b 7d 29 2e 67 65 6f 4f 62 6a 65 63 74 49 64 29 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 62 65 61 63 68 5f 6e 61 6d 65 22 2c 6f 2e 4d 47 28 28 6f 2e 4d 43 28 62 5b 31 5d 29 7c 7c 7b 7d 29 2e 6e 61 6d 65 29 29 2c 65 2b 3d 66 5b 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 64 65 73 74 5f 69 64 22 2c 6f 2e 4d 47 28 28 6f 2e 4d 43 28 62 5b 31 5d 29 7c 7c 7b 7d 29 2e 75 66 69 29 29 2c 65 2b 3d 66 5b 38 5d 3b 76 61 72 20 74 3d 22 22 3b 6f 2e 4d 4a 28 6f 2e 4d 42 28 62 5b 31 39 5d 29 2b 22 22 21 3d 22 47 41 4c 4c 45 52 59 22 29 26 26 28 74 2b 3d 5b 6f 2e 46 2e 65 6e 74 69 74 69 65 73 28 6f 2e 4d 43 28 62 5b 31 38 5d 29 29 2c 66 5b 33 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 74 2b 3d 5b 66 5b 31 38 5d 2c 6f 2e 4d 43 28 62 5b 32 30 5d 29 Data Ascii: [1])\|\|{}).geoObjectId)),e+=f[0],o.MN("fe_beach_name",o.MG((o.MC(b[1])\|\|{}).name)),e+=f[0],o.MN("fe_dest_id",o.MG((o.MC(b[1])\|\|{}).ufi)),e+=f[8];var t="";o.MJ(o.MB(b[19])+""!="GALLERY")&&(t+=[o.F.entities(o.MC(b[18])),f[31]].join("")),t+=[f[18],o.MC(b[20])
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 74 61 2e 62 5f 62 61 73 69 63 5f 74 79 70 65 26 26 28 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 35 38 66 33 61 32 64 31 22 29 2c 6e 2e 63 6c 6f 73 65 49 57 28 65 2e 69 64 29 2c 5f 72 5f 28 29 7d 2c 31 35 30 29 29 2c 5f 72 5f 28 29 7d 29 2c 6e 2e 6f 6e 28 6e 2e 45 56 45 4e 54 53 2e 4d 41 52 4b 45 52 5f 43 4c 49 43 4b 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 5f 69 5f 28 22 63 62 39 3a 34 61 61 61 35 61 33 31 22 29 2c 22 70 69 6c 6f 74 5f 62 65 61 63 68 22 3d 3d 3d 65 2e 64 61 74 61 2e 62 5f 62 61 73 69 63 5f 74 79 70 65 29 7b 76 61 72 20 74 3d 65 2e 64 61 74 61 2e 62 5f 70 61 6e 65 6c 5f 74 72 69 67 67 65 72 5f 6f 70 74 69 6f 6e 73 7c 7c 7b 7d 3b 74 2e 66 72 6f 6d 4d 61 70 3d 21 30 2c 63 2e 67 Data Ascii: ta.b_basic_type&&(t=setTimeout(function(){_i_("cb9:58f3a2d1"),n.closeIW(e.id),_r_()},150)),_r_()}),n.on(n.EVENTS.MARKER_CLICK,function(e){if(_i_("cb9:4aaa5a31"),"pilot_beach"===e.data.b_basic_type){var t=e.data.b_panel_trigger_options\|\|{};t.fromMap=!0,c.g
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 3a 21 31 2c 70 72 6f 70 65 72 74 69 65 73 4c 69 73 74 3a 65 26 26 65 2e 62 5f 68 6f 74 65 6c 73 26 26 65 2e 62 5f 68 6f 74 65 6c 73 2e 6c 65 6e 67 74 68 3f 65 2e 62 5f 68 6f 74 65 6c 73 3a 5b 5d 7d 29 2c 5f 72 5f 28 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 63 62 39 3a 32 37 63 30 64 33 61 66 22 29 2c 5f 72 5f 28 22 68 6f 74 65 6c 5f 22 2b 65 29 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 63 37 64 30 62 38 30 32 22 29 3b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 2e 6d 61 70 5f 6c 65 66 74 5f 63 61 72 64 73 22 29 3b 65 26 26 5f 2e 70 75 62 6c 69 73 68 28 70 2c 7b 63 6f 6e 74 61 69 6e 65 72 3a 65 7d 29 2c 5f 72 5f 28 29 7d 28 29 2c 73 2e 69 6e 69 Data Ascii: :!1,propertiesList:e&&e.b_hotels&&e.b_hotels.length?e.b_hotels:[]}),_r_()}function r(e){return _i_("cb9:27c0d3af"),_r_("hotel_"+e)}!function(){_i_("cb9:c7d0b802");var e=document.querySelector(".map_left_cards");e&&_.publish(p,{container:e}),_r_()}(),s.ini
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 2e 4d 44 28 70 5b 39 5d 29 26 26 28 74 2b 3d 5b 68 5b 32 35 5d 2c 6c 2e 46 2e 65 6e 74 69 74 69 65 73 28 6c 2e 4d 43 28 70 5b 39 5d 29 29 2c 68 5b 32 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 29 2c 6c 2e 4d 4a 28 31 3c 6c 2e 4d 42 28 70 5b 36 5d 29 29 26 26 28 74 2b 3d 68 5b 32 36 5d 29 2c 6c 2e 4d 44 28 70 5b 31 30 5d 29 26 26 28 74 2b 3d 5b 6c 2e 46 2e 65 6e 74 69 74 69 65 73 28 6c 2e 4d 43 28 70 5b 31 30 5d 29 29 2c 68 5b 32 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 6c 2e 4d 44 28 70 5b 32 5d 29 26 26 28 74 2b 3d 68 5b 32 37 5d 29 2c 74 2b 3d 68 5b 32 38 5d 2c 6c 2e 4d 4a 28 30 3c 6c 2e 4d 42 28 70 5b 31 38 5d 29 29 3f 74 2b 3d 5b 28 63 2e 75 6e 73 68 69 66 74 28 7b 6e 75 6d 5f 6c 69 73 74 73 3a 6c 2e 4d 42 28 70 5b 31 37 5d 29 7d 29 2c 62 3d 6c 2e 4d 45 Data Ascii: .MD(p[9])&&(t+=[h[25],l.F.entities(l.MC(p[9])),h[24]].join(""))),l.MJ(1<l.MB(p[6]))&&(t+=h[26]),l.MD(p[10])&&(t+=[l.F.entities(l.MC(p[10])),h[24]].join("")),l.MD(p[2])&&(t+=h[27]),t+=h[28],l.MJ(0<l.MB(p[18]))?t+=[(c.unshift({num_lists:l.MB(p[17])}),b=l.ME
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 5f 61 67 65 3a 65 7d 2c 66 29 29 7d 29 29 29 2c 64 26 26 28 63 3d 63 2e 63 6f 6e 63 61 74 28 62 28 7b 68 69 67 68 6c 69 67 68 74 65 64 5f 62 6c 6f 63 6b 73 3a 64 7d 2c 66 29 29 29 2c 63 3d 63 2e 63 6f 6e 63 61 74 28 62 28 7b 67 72 6f 75 70 5f 72 6f 6f 6d 73 3a 61 2c 67 72 6f 75 70 5f 61 64 75 6c 74 73 3a 72 2c 67 72 6f 75 70 5f 63 68 69 6c 64 72 65 6e 3a 6f 2c 6e 6f 5f 72 6f 6f 6d 73 3a 61 2c 72 65 71 5f 61 64 75 6c 74 73 3a 72 2c 72 65 71 5f 63 68 69 6c 64 72 65 6e 3a 6f 7d 2c 66 29 29 29 2c 5f 72 5f 28 6c 5b 30 5d 2b 66 2b 63 2e 6a 6f 69 6e 28 66 29 2b 28 6c 5b 31 5d 3f 22 23 22 2b 6c 5b 31 5d 3a 22 22 29 29 7d 2c 67 65 6e 53 65 61 72 63 68 43 6f 6e 66 69 67 51 75 65 72 79 44 65 70 72 65 63 61 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 Data Ascii: _age:e},f))}))),d&&(c=c.concat(b({highlighted_blocks:d},f))),c=c.concat(b({group_rooms:a,group_adults:r,group_children:o,no_rooms:a,req_adults:r,req_children:o},f))),_r_(l[0]+f+c.join(f)+(l[1]?"#"+l[1]:""))},genSearchConfigQueryDeprecated:function(e,t){_i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.5	49895	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	736	OUT	GET /static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 120436 Connection: close Server: nginx Date: Fri, 22 Dec 2023 15:18:36 GMT Last-Modified: Thu, 26 Oct 2023 09:29:15 GMT Expires: Sun, 21 Jan 2024 15:18:36 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "653a316b-1d674" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 1HlBiwKaZ4E_1W-T2xnbZiAs_4O8wcSQrbMQ3yGPYSMyotGZHhrEpA== Age: 2102266
2024-01-15 23:16:22 UTC	15574	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 61 74 6c 61 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 64 30 62 3a 33 35 35 37 63 30 37 61 22 29 3b 76 61 72 20 74 3d 22 41 74 6c 61 73 2f 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 32 31 32 32 33 32 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas={loaded:!0,run:!1}),function(){"use strict";_i_("d0b:3557c07a");var t="Atlas/";function i(e){return _i_("d0b:212232
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 73 77 2e 74 6f 53 74 72 69 6e 67 28 29 2c 22 2c 22 2c 22 4e 45 3a 22 2c 74 68 69 73 2e 6e 65 2e 74 6f 53 74 72 69 6e 67 28 29 5d 2e 6a 6f 69 6e 28 22 20 22 29 29 7d 7d 2c 5f 72 5f 28 6f 29 7d 29 2c 42 2e 61 74 6c 61 73 2e 64 65 66 69 6e 65 28 22 67 65 6f 2e 6c 61 74 4c 6e 67 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 76 61 72 20 72 3b 5f 69 5f 28 22 64 30 62 3a 61 31 61 39 33 62 65 35 22 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 30 3c 65 2e 69 6e 64 65 78 4f 66 28 22 2c 22 29 3f 28 72 3d 65 2e 73 70 6c 69 74 28 22 2c 22 29 2c 74 68 69 73 2e 6c 61 74 3d 2b 72 5b 30 5d 2c 74 68 69 73 2e 6c 6e 67 3d 2b 72 5b 31 5d 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 Data Ascii: sw.toString(),",","NE:",this.ne.toString()].join(" "))}},_r_(o)}),B.atlas.define("geo.latLng",function(){"use strict";function e(e,t){var r;_i_("d0b:a1a93be5"),"string"==typeof e&&0<e.indexOf(",")?(r=e.split(","),this.lat=+r[0],this.lng=+r[1]):"object"==t
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 5d 2c 5f 72 5f 28 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 64 30 62 3a 34 61 39 33 63 34 64 30 22 29 3b 76 61 72 20 72 3d 74 68 69 73 3b 69 66 28 22 64 65 66 61 75 6c 74 22 21 3d 3d 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 65 2e 65 61 63 68 28 69 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 64 30 62 3a 31 36 66 33 66 30 35 33 22 29 2c 74 2e 63 6f 6e 64 69 74 69 6f 6e 26 26 72 2e 6f 6e 28 74 2e 65 76 74 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 64 30 62 3a 65 65 37 62 31 66 64 66 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 5f 69 5f 28 22 64 30 62 3a 38 64 35 37 32 34 34 36 22 29 2c 74 2e 66 69 6c 74 65 72 26 26 21 74 2e 66 69 6c 74 65 72 2e 61 70 70 Data Ascii: ],_r_({init:function(){_i_("d0b:4a93c4d0");var r=this;if("default"!==this.get("id"))return _r_();e.each(i,function(e,t){_i_("d0b:16f3f053"),t.condition&&r.on(t.evt,function(){_i_("d0b:ee7b1fdf"),function(e,t){if(_i_("d0b:8d572446"),t.filter&&!t.filter.app
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 3b 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 35 62 66 38 30 61 38 33 22 29 2c 5f 72 5f 28 7b 73 65 74 4f 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 64 30 62 3a 38 63 32 64 37 32 38 31 22 29 3b 76 61 72 20 72 3d 6e 65 77 20 69 28 65 2c 74 29 3b 74 68 69 73 2e 73 65 74 28 22 6f 66 66 73 65 74 22 2c 72 29 2c 74 68 69 73 2e 74 72 69 67 67 65 72 28 22 6f 66 66 73 65 74 2d 63 68 61 6e 67 65 22 2c 72 29 2c 5f 72 5f 28 29 7d 7d 29 7d 29 2c 42 2e 61 74 6c 61 73 2e 64 65 66 69 6e 65 28 22 6f 70 74 69 6f 6e 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 31 31 31 33 35 34 36 65 22 29 2c 5f 72 5f 28 7b 63 6f 6e 66 69 67 5a 6f 6f 6d 43 6f 6e 74 72 6f Data Ascii: ;return _i_("d0b:5bf80a83"),_r_({setOffset:function(e,t){_i_("d0b:8c2d7281");var r=new i(e,t);this.set("offset",r),this.trigger("offset-change",r),_r_()}})}),B.atlas.define("options",function(){"use strict";return _i_("d0b:1113546e"),_r_({configZoomContro
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 73 4f 70 65 6e 26 26 74 68 69 73 2e 73 65 74 50 6f 73 69 74 69 6f 6e 28 29 3a 28 74 68 69 73 2e 24 64 6f 6d 4e 6f 64 65 3d 6c 28 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 27 2b 61 2b 27 22 2f 3e 27 29 2c 74 68 69 73 2e 24 64 6f 6d 4e 6f 64 65 2e 61 70 70 65 6e 64 54 6f 28 72 29 2e 62 69 6e 64 28 22 6d 6f 75 73 65 6d 6f 76 65 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 32 61 64 34 35 38 65 35 22 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 5f 72 5f 28 29 7d 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 65 2e 63 6c 6f 73 65 53 65 6c 65 63 74 6f 72 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 36 31 31 30 64 32 30 36 22 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 74 2e 63 6c 6f 73 Data Ascii: sOpen&&this.setPosition():(this.$domNode=l('<div class="'+a+'"/>'),this.$domNode.appendTo(r).bind("mousemove",function(e){_i_("d0b:2ad458e5"),e.stopPropagation(),_r_()}).on("click",e.closeSelector,function(e){_i_("d0b:6110d206"),e.stopPropagation(),t.clos
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 28 22 61 74 6c 61 73 22 29 2c 72 3d 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 3b 74 2e 67 65 74 50 6c 61 63 65 44 65 74 61 69 6c 73 28 7b 70 6c 61 63 65 49 64 3a 72 7d 2c 65 2c 74 68 69 73 29 2c 5f 72 5f 28 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 4d 61 72 6b 65 72 43 6f 6e 66 69 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 31 34 38 65 35 64 36 37 22 29 3b 76 61 72 20 74 2c 72 3d 74 68 69 73 2e 67 65 74 28 22 63 6f 6f 72 64 69 6e 61 74 65 73 22 29 3b 72 65 74 75 72 6e 20 74 3d 7b 62 5f 69 64 3a 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 2c 62 5f 6c 61 74 69 74 75 64 65 3a 72 2e 6c 61 74 2c 62 5f 6c 6f 6e 67 69 74 75 64 65 3a 72 2e 6c 6e 67 2c 64 61 74 61 3a 74 68 69 73 2e 67 65 74 28 22 64 61 74 61 22 29 7d 2c 6f 2e 65 Data Ascii: ("atlas"),r=this.get("id");t.getPlaceDetails({placeId:r},e,this),_r_()},e.prototype.getMarkerConfig=function(e){_i_("d0b:148e5d67");var t,r=this.get("coordinates");return t={b_id:this.get("id"),b_latitude:r.lat,b_longitude:r.lng,data:this.get("data")},o.e
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 33 65 32 62 63 22 29 2c 74 68 69 73 2e 5f 72 65 61 64 79 3d 21 31 2c 65 2e 6c 61 74 4c 6e 67 3f 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 3d 6e 65 77 20 67 6f 6f 67 6c 65 2e 6d 61 70 73 2e 4c 61 74 4c 6e 67 28 65 2e 6c 61 74 4c 6e 67 29 3a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 62 5f 6c 61 74 69 74 75 64 65 22 29 26 26 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 62 5f 6c 6f 6e 67 69 74 75 64 65 22 29 26 26 28 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 3d 6e 65 77 20 67 6f 6f 67 6c 65 2e 6d 61 70 73 2e 4c 61 74 4c 6e 67 28 65 2e 62 5f 6c 61 74 69 74 75 64 65 2c 65 2e 62 5f 6c 6f 6e 67 69 74 75 64 65 29 29 2c 74 68 69 73 2e 64 61 74 61 3d 65 2c 74 68 69 73 2e 62 5f 69 64 3d 65 2e 62 5f 69 64 2c 74 68 69 73 2e 62 5f 61 74 6c 61 73 5f 69 64 Data Ascii: 3e2bc"),this._ready=!1,e.latLng?this.position=new google.maps.LatLng(e.latLng):e.hasOwnProperty("b_latitude")&&e.hasOwnProperty("b_longitude")&&(this.position=new google.maps.LatLng(e.b_latitude,e.b_longitude)),this.data=e,this.b_id=e.b_id,this.b_atlas_id
2024-01-15 23:16:22 UTC	6558	IN	Data Raw: 6c 69 66 69 65 64 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 72 6f 61 64 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 6c 61 62 65 6c 73 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 76 69 73 69 62 69 6c 69 74 79 3a 22 6f 66 66 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 77 61 74 65 72 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 61 6c 6c 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 68 75 65 3a 22 23 30 30 33 35 38 30 22 7d 2c 7b 76 69 73 69 62 69 6c 69 74 79 3a 22 6f 6e 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 2e 63 6f 75 6e 74 72 79 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 73 74 72 6f 6b 65 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 63 6f 6c 6f 72 3a 22 23 66 38 66 36 65 65 22 7d 2c 7b 77 65 Data Ascii: lified"}]},{featureType:"road",elementType:"labels",stylers:[{visibility:"off"}]},{featureType:"water",elementType:"all",stylers:[{hue:"#003580"},{visibility:"on"}]},{featureType:"administrative.country",elementType:"stroke",stylers:[{color:"#f8f6ee"},{we

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.5	49892	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	912	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360575042 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:22 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Mon, 15 Jan 2024 23:16:22 GMT Date: Mon, 15 Jan 2024 23:16:22 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:22 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-01-15 23:16:22 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-x
2024-01-15 23:16:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.5	49899	172.253.115.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	827	OUT	GET /gsi/style HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:22 UTC	1125	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Expires: Mon, 15 Jan 2024 23:16:22 GMT Date: Mon, 15 Jan 2024 23:16:22 GMT Cache-Control: private, max-age=86400 Content-Security-Policy: script-src 'report-sample' 'nonce-KQn3ghIKyGp3kgioAc_BQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:22 UTC	127	IN	Data Raw: 32 31 35 0d 0a 23 63 72 65 64 65 6e 74 69 61 6c 5f 70 69 63 6b 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 33 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 32 30 70 78 3b 74 6f 70 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 39 31 70 78 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 7d 23 63 72 65 64 65 6e 74 Data Ascii: 215#credential_picker_container{border:none;height:330px;position:fixed;right:20px;top:20px;width:391px;z-index:9999}#credent
2024-01-15 23:16:22 UTC	413	IN	Data Raw: 69 61 6c 5f 70 69 63 6b 65 72 5f 63 6f 6e 74 61 69 6e 65 72 20 69 66 72 61 6d 65 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 33 39 31 70 78 3b 68 65 69 67 68 74 3a 33 33 30 70 78 7d 23 67 5f 61 31 31 79 5f 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 7b 68 65 69 67 68 74 3a 31 70 78 3b 6c 65 66 74 3a 2d 31 30 30 30 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 61 75 74 6f 3b 77 69 64 74 68 3a 31 70 78 7d 2e 4c 35 46 6f 36 63 2d 73 4d 35 4d 4e 62 7b 62 6f 72 64 65 72 3a 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 30 7d 2e 4c 35 46 6f 36 63 2d 62 46 31 75 55 62 7b 2d 77 65 62 6b 69 74 Data Ascii: ial_picker_container iframe{border:none;width:391px;height:330px}#g_a11y_announcement{height:1px;left:-10000px;overflow:hidden;position:absolute;top:auto;width:1px}.L5Fo6c-sM5MNb{border:0;display:block;left:0;position:relative;top:0}.L5Fo6c-bF1uUb{-webkit
2024-01-15 23:16:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.5	49900	172.253.122.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Mon, 15 Jan 2024 23:16:22 GMT Date: Mon, 15 Jan 2024 23:16:22 GMT Cache-Control: private, max-age=3600 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-2IqHGiwGBW2Vp87K6wt4dA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:22 UTC	164	IN	Data Raw: 32 64 61 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 2da{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-01-15 23:16:22 UTC	573	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-01-15 23:16:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.5	49898	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	740	OUT	GET /static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 621029 Connection: close Server: nginx Date: Wed, 10 Jan 2024 12:45:08 GMT Last-Modified: Wed, 10 Jan 2024 11:45:34 GMT ETag: "659e835e-979e5" Expires: Fri, 09 Feb 2024 12:45:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 67711c5cba0352ee130f60f6cc103e0a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: TQBvnKSJAvZAEPYD2RQamt2N2lOyT2qBFinMxgzlmtVJuYHlDyLoOA== Age: 469873
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 61 74 6c 61 73 5f 63 73 74 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 62 6f 6f 6b 69 6e 67 2e 6a 73 74 6d 70 6c 28 22 61 74 6c 61 73 5f 69 77 5f 64 65 66 61 75 6c 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 37 33 3a 32 66 38 63 34 64 64 38 22 29 3b 76 61 72 20 69 3d 5b 27 5c 6e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 77 2d 63 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas_cst={loaded:!0,run:!1}),booking.jstmpl("atlas_iw_default",function(){_i_("373:2f8c4dd8");var i=['\n<div class="iw-c
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 43 28 73 5b 39 5d 29 2c 69 2e 4d 43 28 73 5b 31 30 5d 29 2c 72 5b 31 30 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 69 2e 4d 4b 28 69 2e 41 54 4c 41 53 5f 45 4e 56 28 22 69 73 50 61 72 74 6e 65 72 34 31 33 30 38 34 22 29 29 26 26 28 5f 2b 3d 72 5b 32 35 5d 29 2c 5f 2b 3d 5b 72 5b 31 30 35 5d 2c 69 2e 4d 43 28 73 5b 35 34 5d 29 2c 72 5b 31 30 36 5d 2c 69 2e 4d 42 28 73 5b 35 36 5d 29 2c 72 5b 31 30 37 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 5f 72 5f 28 5f 29 7d 29 7d 28 29 29 2c 62 6f 6f 6b 69 6e 67 2e 6a 73 74 6d 70 6c 28 22 61 74 6c 61 73 5f 69 77 5f 6d 69 6e 69 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 37 33 3a 38 34 34 30 30 32 36 36 22 29 3b 76 61 72 20 74 2c 61 3d 5b 22 5c 6e 20 20 20 20 22 2c 22 5c 6e 5c 6e 20 20 20 20 22 2c 22 5c 6e 20 20 20 Data Ascii: C(s[9]),i.MC(s[10]),r[104]].join(""),i.MK(i.ATLAS_ENV("isPartner413084"))&&(_+=r[25]),_+=[r[105],i.MC(s[54]),r[106],i.MB(s[56]),r[107]].join(""),_r_(_)})}()),booking.jstmpl("atlas_iw_mini",function(){_i_("373:84400266");var t,a=["\n ","\n\n ","\n
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 6f 72 3a 22 23 36 42 36 42 36 42 22 2c 6e 61 6d 65 3a 61 5b 39 33 5d 2c 73 69 7a 65 3a 61 5b 39 34 5d 7d 29 2c 74 3d 69 2e 48 45 4c 50 45 52 28 22 69 63 6f 6e 22 2c 5f 5b 30 5d 29 2c 5f 2e 73 68 69 66 74 28 29 2c 74 29 2c 61 5b 32 30 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 29 3a 65 2b 3d 5b 28 5f 2e 75 6e 73 68 69 66 74 28 7b 6e 75 6d 5f 72 65 76 69 65 77 73 3a 69 2e 66 6f 72 6d 61 74 5f 6e 75 6d 62 65 72 28 69 2e 4d 42 28 72 5b 35 34 5d 29 29 7d 29 2c 74 3d 69 2e 4d 45 28 61 5b 39 35 5d 2c 69 2e 4d 42 2c 69 2e 4d 4e 2c 69 2e 4d 4f 28 69 2e 4d 49 28 69 2e 4d 43 28 72 5b 35 34 5d 29 29 2b 69 2e 4d 49 28 30 29 2c 6e 75 6c 6c 2c 61 5b 39 35 5d 29 29 2c 5f 2e 73 68 69 66 74 28 29 2c 74 29 2c 61 5b 32 30 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 65 2b 3d 61 5b 39 36 5d Data Ascii: or:"#6B6B6B",name:a[93],size:a[94]}),t=i.HELPER("icon",_[0]),_.shift(),t),a[20]].join(""))):e+=[(_.unshift({num_reviews:i.format_number(i.MB(r[54]))}),t=i.ME(a[95],i.MB,i.MN,i.MO(i.MI(i.MC(r[54]))+i.MI(0),null,a[95])),_.shift(),t),a[20]].join(""),e+=a[96]
2024-01-15 23:16:22 UTC	14808	IN	Data Raw: 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 22 2c 27 5c 6e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 77 5f 6d 69 6e 69 5f 70 72 69 63 65 5f 77 72 61 70 70 65 72 27 2c 22 20 69 77 5f 6d 69 6e 69 5f 70 72 69 63 65 2d 2d 73 6f 6c 64 6f 75 74 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 77 5f 6d 69 6e 69 5f 73 6f 6c 64 6f 75 74 20 73 6f 6c 64 6f 75 74 5f 73 74 79 6c 65 22 3e 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 74 27 2c 22 3c 62 72 2f 3e 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 74 22 2c 22 3c 62 72 2f 3e 5c 6e 5c 74 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 22 5c 6e 5c 74 Data Ascii: \n ","\n </div>\n ",'\n\n <div class="iw_mini_price_wrapper'," iw_mini_price--soldout",'\n <span class="iw_mini_soldout soldout_style">\n\t\t\t\t\t',"<br/>\n\t\t\t\t\t","<br/>\n\t ","\n\t
2024-01-15 23:16:22 UTC	267	IN	Data Raw: 6e 2b 3d 6c 5b 38 5d 29 2c 6e 2b 3d 6c 5b 31 30 5d 2c 72 2e 4d 4a 28 39 3c 3d 72 2e 4d 42 28 63 5b 37 38 5d 29 29 26 26 72 2e 4d 4a 28 72 2e 4d 42 28 63 5b 37 38 5d 29 3c 39 2e 35 29 26 26 28 6e 2b 3d 6c 5b 36 35 5d 2c 72 2e 4d 4e 28 22 66 65 5f 72 61 74 69 6e 67 5f 61 64 6a 22 2c 22 31 30 22 29 2c 6e 2b 3d 6c 5b 38 5d 29 2c 6e 2b 3d 6c 5b 31 30 5d 2c 72 2e 4d 4a 28 39 2e 35 3c 3d 72 2e 4d 42 28 63 5b 37 38 5d 29 29 26 26 28 6e 2b 3d 6c 5b 36 35 5d 2c 72 2e 4d 4e 28 22 66 65 5f 72 61 74 69 6e 67 5f 61 64 6a 22 2c 22 31 31 22 29 2c 6e 2b 3d 6c 5b 38 5d 29 2c 65 3d 5f 72 5f 28 6e 29 2c 65 2b 3d 6c 5b 31 30 5d 2c 65 2b 3d 6c 5b 31 30 5d 2c 5f 3d 22 22 2c 5f 2b 3d 6c 5b 36 35 5d 2c 72 2e 4d 44 28 63 5b 35 36 5d 29 26 26 28 5f 2b 3d 6c 5b 39 35 5d 2c 72 2e 4d Data Ascii: n+=l[8]),n+=l[10],r.MJ(9<=r.MB(c[78]))&&r.MJ(r.MB(c[78])<9.5)&&(n+=l[65],r.MN("fe_rating_adj","10"),n+=l[8]),n+=l[10],r.MJ(9.5<=r.MB(c[78]))&&(n+=l[65],r.MN("fe_rating_adj","11"),n+=l[8]),e=_r_(n),e+=l[10],e+=l[10],_="",_+=l[65],r.MD(c[56])&&(_+=l[95],r.M
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 3d 5b 6c 5b 39 36 5d 2c 72 2e 4d 42 28 63 5b 38 30 5d 29 2c 6c 5b 39 33 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 72 2e 4d 44 28 63 5b 38 31 5d 29 26 26 28 5f 2b 3d 5b 6c 5b 39 37 5d 2c 72 2e 4d 42 28 63 5b 38 31 5d 29 2c 6c 5b 39 33 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 29 3a 5f 2b 3d 6c 5b 39 38 5d 2c 5f 2b 3d 5b 6c 5b 39 39 5d 2c 28 61 2e 75 6e 73 68 69 66 74 28 7b 72 61 74 69 6e 67 5f 61 64 6a 65 63 74 69 76 65 3a 72 2e 4d 42 28 63 5b 38 32 5d 29 7d 29 2c 4d 3d 72 2e 4d 45 28 6c 5b 31 30 30 5d 2c 72 2e 4d 42 2c 72 2e 4d 4e 2c 6e 75 6c 6c 29 2c 61 2e 73 68 69 66 74 28 29 2c 4d 29 2c 6c 5b 31 30 31 5d 2c 72 2e 4d 42 28 63 5b 35 36 5d 29 2c 6c 5b 31 30 32 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 72 2e 4d 44 28 63 5b 38 30 5d 29 3f 5f 2b 3d 6c 5b 31 30 33 5d 3a 5f 2b Data Ascii: =[l[96],r.MB(c[80]),l[93]].join(""),r.MD(c[81])&&(_+=[l[97],r.MB(c[81]),l[93]].join(""))):_+=l[98],_+=[l[99],(a.unshift({rating_adjective:r.MB(c[82])}),M=r.ME(l[100],r.MB,r.MN,null),a.shift(),M),l[101],r.MB(c[56]),l[102]].join(""),r.MD(c[80])?_+=l[103]:_+
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 6f 6c 6f 72 4d 61 74 72 69 78 20 76 61 6c 75 65 73 3d 22 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 2e 32 20 30 22 20 69 6e 3d 22 73 68 61 64 6f 77 42 6c 75 72 4f 75 74 65 72 31 22 20 72 65 73 75 6c 74 3d 22 73 68 61 64 6f 77 4d 61 74 72 69 78 4f 75 74 65 72 31 22 2f 3e 5c 6e 20 20 20 20 20 20 3c 66 65 4d 6f 72 70 68 6f 6c 6f 67 79 20 72 61 64 69 75 73 3d 22 31 22 20 6f 70 65 72 61 74 6f 72 3d 22 64 69 6c 61 74 65 22 20 69 6e 3d 22 53 6f 75 72 63 65 41 6c 70 68 61 22 20 72 65 73 75 6c 74 3d 22 73 68 61 64 6f 77 53 70 72 65 61 64 4f 75 74 65 72 32 22 2f 3e 5c 6e 20 20 20 20 20 20 3c 66 65 4f 66 66 73 65 74 20 64 79 3d 22 32 22 20 69 6e 3d 22 73 68 61 64 6f 77 53 70 72 65 61 64 4f 75 74 65 Data Ascii: olorMatrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.2 0" in="shadowBlurOuter1" result="shadowMatrixOuter1"/>\n <feMorphology radius="1" operator="dilate" in="SourceAlpha" result="shadowSpreadOuter2"/>\n <feOffset dy="2" in="shadowSpreadOute
2024-01-15 23:16:22 UTC	16384	IN	Data Raw: 37 20 39 2e 30 30 30 30 37 20 31 33 2e 30 31 33 32 5a 22 20 66 69 6c 6c 3d 22 23 46 46 38 30 30 30 22 2f 3e 5c 6e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 75 6d 62 72 65 6c 6c 61 22 20 64 3d 22 4d 31 33 2e 32 32 31 36 20 36 2e 35 36 37 36 39 4c 31 32 2e 37 39 32 39 20 35 2e 33 33 35 36 39 43 31 32 2e 37 30 32 31 20 35 2e 30 37 34 38 38 20 31 32 2e 34 31 37 32 20 34 2e 39 33 37 30 32 20 31 32 2e 31 35 36 34 20 35 2e 30 32 37 37 37 43 31 31 2e 38 39 35 35 20 35 2e 31 31 38 35 31 20 31 31 2e 37 35 37 37 20 35 2e 34 30 33 35 20 31 31 2e 38 34 38 34 20 35 2e 36 36 34 33 31 4c 31 32 2e 32 37 37 31 20 36 2e 38 39 36 33 31 43 31 32 2e 33 36 37 38 20 37 2e 31 35 37 31 31 20 31 32 2e 36 35 32 38 20 37 2e 32 39 34 39 38 20 31 32 2e 39 31 33 36 20 37 2e 32 30 34 32 33 Data Ascii: 7 9.00007 13.0132Z" fill="#FF8000"/>\n<path class="umbrella" d="M13.2216 6.56769L12.7929 5.33569C12.7021 5.07488 12.4172 4.93702 12.1564 5.02777C11.8955 5.11851 11.7577 5.4035 11.8484 5.66431L12.2771 6.89631C12.3678 7.15711 12.6528 7.29498 12.9136 7.20423
2024-01-15 23:16:22 UTC	14808	IN	Data Raw: 2e 34 63 2d 2e 33 36 2e 31 2d 2e 37 31 2e 32 31 2d 31 2e 30 37 2e 33 34 61 31 31 2e 36 35 20 31 31 2e 36 35 20 30 20 30 20 30 2d 36 2e 38 33 20 36 2e 38 34 4c 34 32 2e 32 35 20 33 38 2e 33 31 48 31 32 2e 31 38 61 31 31 2e 36 37 20 31 31 2e 36 37 20 30 20 30 20 30 2d 31 31 2e 31 33 20 38 2e 31 38 41 31 31 2e 33 39 20 31 31 2e 33 39 20 30 20 30 20 30 20 2e 35 32 20 35 30 61 31 31 2e 36 35 20 31 31 2e 36 35 20 30 20 30 20 30 20 34 2e 31 39 20 39 6c 32 35 2e 37 31 20 32 31 2e 32 34 2d 31 30 2e 38 31 20 33 32 2e 34 31 41 31 31 2e 36 38 20 31 31 2e 36 38 20 30 20 30 20 30 20 32 37 20 31 32 37 2e 34 63 2e 34 2e 31 33 2e 38 31 2e 32 33 20 31 2e 32 31 2e 33 32 6c 2e 33 31 2e 30 36 61 39 2e 33 31 20 39 2e 33 31 20 30 20 30 20 30 20 31 2e 31 38 2e 31 37 68 31 2e 35 Data Ascii: .4c-.36.1-.71.21-1.07.34a11.65 11.65 0 0 0-6.83 6.84L42.25 38.31H12.18a11.67 11.67 0 0 0-11.13 8.18A11.39 11.39 0 0 0 .52 50a11.65 11.65 0 0 0 4.19 9l25.71 21.24-10.81 32.41A11.68 11.68 0 0 0 27 127.4c.4.13.81.23 1.21.32l.31.06a9.31 9.31 0 0 0 1.18.17h1.5
2024-01-15 23:16:22 UTC	1576	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 73 74 72 69 6b 65 74 68 72 6f 75 67 68 2d 76 61 6c 75 65 3d 22 27 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 62 75 69 2d 63 6f 6d 70 6f 6e 65 6e 74 3d 22 50 6f 70 6f 76 65 72 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 70 6f 70 6f 76 65 72 2d 70 6f 73 69 74 69 6f 6e 3d 22 74 6f 70 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 61 62 69 6e 64 65 78 3d 22 30 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 70 6f 70 6f 76 65 72 2d 63 6f 6e 74 65 6e 74 2d 69 64 3d 22 27 2c 27 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 70 6f 70 6f 76 65 72 2d 7a 2d 69 6e 64 65 78 3d 22 31 30 30 31 22 5c 6e 20 Data Ascii: data-strikethrough-value="','\n data-bui-component="Popover"\n data-popover-position="top"\n tabindex="0"\n data-popover-content-id="','"\n data-popover-z-index="1001"\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.5	49901	172.253.115.102	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	386	OUT	GET /.well-known/web-identity HTTP/1.1 Host: google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:22 UTC	466	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/.well-known/web-identity Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 244 X-XSS-Protection: 0 Date: Mon, 15 Jan 2024 23:08:50 GMT Expires: Mon, 15 Jan 2024 23:38:50 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 452 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:22 UTC	244	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2e 77 65 6c 6c 2d 6b 6e 6f 77 6e 2f 77 65 62 2d 69 64 65 6e 74 69 74 79 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/.well-known/web-identity">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.5	49903	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	2445	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1354 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qNF0ZHmS5p9m4Xj6FY62OGjd%2Fl1%2Bx3krnHYGmNV5rUA38ew7Rw7xrGki0gdFw5Ifmwow377oSKjqpT0UJOPqG59oJvemtx4oVFtxuY5mK12JgIqB%2BgANSYJ5%2BLh6aNFMLKpO8JtzsixiNYkDBrlwpKo%3D
2024-01-15 23:16:22 UTC	1354	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 30 7d 2c 7b Data Ascii: {"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_preselected":0},{
2024-01-15 23:16:23 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:23 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedpAqJTi0BVFp6fwmpts3dzlzwvQzO7v%2B2nXdY5KTBJcsRptY6RLggOawcCnJZDdVACmED0vog7L4RcvyMbqIyiaLIlg6BOOd3yU4HKNbPy7l5Dg13GfNy%2Bz%2BJbrbdAVOjxxiKcJV944Jn4ZRsLABnmfRn7YxNfpoE%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:23 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=85cda3a3ea120089&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssnn4K6AvRBCtYy6PhlLgIA72jOdld1R9Y x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 4Z0hDZF_lttT5EIrSCEPS2kmp3lsbfJymOaw6LDIdFZoASEcoLrmeg==
2024-01-15 23:16:23 UTC	21	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 39 2c 22 73 74 61 74 75 73 22 3a 30 7d Data Ascii: {"code":9,"status":0}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.5	49904	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	2444	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 515 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qNF0ZHmS5p9m4Xj6FY62OGjd%2Fl1%2Bx3krnHYGmNV5rUA38ew7Rw7xrGki0gdFw5Ifmwow377oSKjqpT0UJOPqG59oJvemtx4oVFtxuY5mK12JgIqB%2BgANSYJ5%2BLh6aNFMLKpO8JtzsixiNYkDBrlwpKo%3D
2024-01-15 23:16:22 UTC	515	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 61 72 64 22 3a 5b 5d 2c 22 70 61 67 65 5f 72 65 67 69 6f 6e 22 3a 22 49 6e 64 65 78 50 61 67 65 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 42 55 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 Data Ascii: {"action_name":"webcoreux.global_alert_component_served","action_version":"2.0.0","content":{"global_alert_card":[],"page_region":"IndexPage","vertical":"ABU"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booki
2024-01-15 23:16:23 UTC	1179	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:23 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:23 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6d1ea3a39bed0056&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu4w8W6R59WQ169wrahLCqk0ZLc6Jt26jw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7b32163caf7e91fe96df7bbeaa58c0f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Hntmh5gQLJLRTUutabqHMZIkK0eMR8YFLqrE10inJFLiw2J_23k-ng==
2024-01-15 23:16:23 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.5	49906	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	740	OUT	GET /static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:23 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 52156 Connection: close Server: nginx Date: Mon, 01 Jan 2024 10:05:42 GMT Last-Modified: Tue, 12 Jan 2021 10:06:38 GMT ETag: "5ffd74ae-cbbc" Expires: Wed, 31 Jan 2024 10:05:42 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: wbfNM0QmHnWX2wdLjDy5knTDEAu1Q_IObIW0y7y8R5TMls_vSysFWw== Age: 1257041
2024-01-15 23:16:23 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 63 61 6c 65 6e 64 61 72 32 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 62 6f 6f 6b 69 6e 67 2e 65 6e 73 75 72 65 4e 61 6d 65 73 70 61 63 65 45 78 69 73 74 73 28 22 63 61 6c 65 6e 64 61 72 32 22 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 73 2c 74 2c 65 29 7b 5f 69 5f 28 22 61 34 31 3a 34 61 64 39 62 39 62 31 22 29 2c 73 2e 4f 4e 45 5f 44 41 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.calendar2={loaded:!0,run:!1}),booking.ensureNamespaceExists("calendar2"),function(n,r,s,t,e){_i_("a41:4ad9b9b1"),s.ONE_DA
2024-01-15 23:16:23 UTC	16384	IN	Data Raw: 77 69 64 74 68 3a 27 2b 6e 2b 27 3b 22 20 63 6c 61 73 73 3d 22 27 2b 74 68 69 73 2e 67 65 74 43 61 6c 65 6e 64 61 72 43 6c 61 73 73 6e 61 6d 65 28 29 2b 27 22 20 72 6f 6c 65 3d 22 64 69 61 6c 6f 67 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 27 2b 68 2b 27 22 20 61 72 69 61 2d 6d 6f 64 61 6c 3d 22 74 72 75 65 22 3e 3c 64 69 76 20 72 6f 6c 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 63 61 6c 65 6e 64 61 72 2d 68 65 61 64 65 72 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 27 2b 6c 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 3e 27 2b 74 2b 69 2b 61 2b 27 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 63 61 6c 65 6e 64 61 72 2d 62 6f 64 79 22 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 Data Ascii: width:'+n+';" class="'+this.getCalendarClassname()+'" role="dialog" aria-label="'+h+'" aria-modal="true"><div role="application"><div class="c2-calendar-header" aria-label="'+l+'" tabindex="-1" >'+t+i+a+'</div><div class="c2-calendar-body" role="presentat
2024-01-15 23:16:23 UTC	16384	IN	Data Raw: 3d 65 2e 76 61 6c 75 65 2c 6e 3d 6f 2e 6d 6f 6e 74 68 49 64 28 69 2e 79 65 61 72 2c 69 2e 6d 6f 6e 74 68 29 3b 74 68 69 73 2e 73 65 6c 65 63 74 4d 6f 6e 74 68 28 6e 29 2c 5f 72 5f 28 29 7d 2c 6f 6e 45 78 74 65 72 6e 61 6c 44 61 74 65 53 65 6c 65 63 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 5f 69 5f 28 22 61 34 31 3a 31 33 34 36 63 39 63 36 22 29 3b 76 61 72 20 69 2c 6e 3d 65 2e 76 61 6c 75 65 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 21 28 69 3d 6f 2e 64 61 79 49 64 28 6e 2e 79 65 61 72 2c 6e 2e 6d 6f 6e 74 68 2c 6e 2e 64 61 74 65 29 29 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 74 68 69 73 2e 67 65 74 43 75 72 72 65 6e 74 44 61 79 28 29 3d 3d 3d 69 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 74 68 69 73 2e 73 Data Ascii: =e.value,n=o.monthId(i.year,i.month);this.selectMonth(n),_r_()},onExternalDateSelected:function(t,e){_i_("a41:1346c9c6");var i,n=e.value;if(!n)return _r_();if(!(i=o.dayId(n.year,n.month,n.date)))return _r_();if(this.getCurrentDay()===i)return _r_();this.s
2024-01-15 23:16:23 UTC	3004	IN	Data Raw: 22 74 72 75 65 22 3e 27 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 3d 36 3b 64 2b 2b 29 72 2b 3d 27 3c 74 68 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 20 63 6c 61 73 73 3d 22 63 32 2d 6d 6f 6e 74 68 2d 68 65 61 64 65 72 2d 64 61 79 6e 61 6d 65 22 3e 27 2c 72 2b 3d 27 3c 61 62 62 72 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 27 2b 74 68 69 73 2e 63 61 6c 65 6e 64 61 72 5f 2e 6f 70 74 69 6f 6e 73 2e 64 61 79 4e 61 6d 65 73 5b 64 5d 2b 22 3c 2f 61 62 62 72 3e 22 2c 72 2b 3d 22 3c 2f 74 64 3e 22 3b 72 2b 3d 22 3c 2f 74 72 3e 22 2c 72 2b 3d 22 3c 2f 74 68 65 61 64 3e 22 2c 72 2b 3d 27 3c 74 62 6f 64 79 20 72 Data Ascii: "true">';for(var d=0;d<=6;d++)r+='<th role="presentation" aria-hidden="true" class="c2-month-header-dayname">',r+='<abbr role="presentation" aria-hidden="true">'+this.calendar_.options.dayNames[d]+"</abbr>",r+="</td>";r+="</tr>",r+="</thead>",r+='<tbody r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.5	49905	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	687	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:23 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 28 Dec 2023 21:11:24 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: IShJ4Dob8xC3HTUx8iXz9zN31BIXHLshAwZkDETntqbgHyqSbNFSoA== Age: 1562699
2024-01-15 23:16:23 UTC	15834	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-01-15 23:16:23 UTC	14786	IN	Data Raw: 09 89 56 cf 5c e4 52 01 aa 83 18 df f8 01 4b c0 ec 49 c7 ad 4d 2c 70 06 cc 52 3b 0e fb 86 2a 78 a5 84 34 63 ec ea d8 18 39 3d 69 01 51 5b 18 ed f4 ab 29 3c c1 58 23 3e 08 c1 fa 55 bb 55 95 a5 73 05 be f3 d9 02 ee 02 a6 7b eb d0 8c 86 15 54 3c 71 08 03 f9 52 03 2f 79 e9 8c d4 a1 58 ae 70 40 3e 8b 53 33 b3 31 dc 54 36 39 e3 15 37 db 2f 1a 01 6e 66 26 21 c8 14 84 31 ad e7 89 14 bc 4e a0 f4 e2 a4 5b 69 5c 85 11 39 63 d1 42 f2 7f 0a 56 b9 9e 45 08 d2 b1 03 b1 a9 e0 96 fe 26 df 1b 48 99 e0 3f 22 90 10 fd 92 75 ce eb 79 80 1c 92 50 d7 6f a1 69 b2 58 f8 65 6f 91 71 34 d2 ef 27 b8 45 ff 00 39 ac ad 22 5d 62 f2 f1 20 96 79 16 dc 0f de b4 9c 00 9d fa d7 55 6b a9 da b3 cb 03 46 de 52 fc b1 b8 3c 1f fe b5 6b 08 f5 2a 29 5c e0 bc 4d 7f b6 e5 e4 b5 0c 93 6d 28 fb 47 0f Data Ascii: V\RKIM,pR;x4c9=iQ[)<X#>UUs{T<qR/yXp@>S31T697/nf&!1N[i\9cBVE&H?"uyPoiXeoq4'E9"]b yUkFR<k)\Mm(G
2024-01-15 23:16:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.5	49907	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:22 UTC	750	OUT	GET /static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:23 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 36716 Connection: close Server: nginx Date: Fri, 22 Dec 2023 09:04:39 GMT Last-Modified: Tue, 04 Feb 2020 10:19:58 GMT ETag: "5e39454e-8f6c" Expires: Sun, 21 Jan 2024 09:04:39 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 90ad2a23a8617490c9d13e1f260633f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: wv4e22GpBYQJjf-V08oYnWhKcBv1FJS9wTN19wgCkZ0KcYLiLBSYLQ== Age: 2124704
2024-01-15 23:16:23 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 20 69 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 30 33 39 62 3a 63 39 37 30 64 36 63 38 22 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 69 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 69 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 29 3a 69 28 6a 51 75 65 72 79 29 2c 5f 72 5f 28 29 7d 28 66 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};!function(i){"use strict";_i_("039b:c970d6c8"),"function"==typeof define&&define.amd?define(["jquery"],i):"undefined"!=typeof exports?module.exports=i(require("jquery")):i(jQuery),_r_()}(f
2024-01-15 23:16:23 UTC	16384	IN	Data Raw: 64 28 22 6d 6f 75 73 65 65 6e 74 65 72 2e 73 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 30 33 39 62 3a 65 62 36 38 30 32 30 61 22 29 2c 69 2e 70 61 75 73 65 64 3d 21 30 2c 69 2e 61 75 74 6f 50 6c 61 79 43 6c 65 61 72 28 29 2c 5f 72 5f 28 29 7d 29 2e 62 69 6e 64 28 22 6d 6f 75 73 65 6c 65 61 76 65 2e 73 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 30 33 39 62 3a 35 65 34 38 64 66 32 35 22 29 2c 69 2e 70 61 75 73 65 64 3d 21 31 2c 69 2e 61 75 74 6f 50 6c 61 79 28 29 2c 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 69 61 6c 69 7a 65 45 76 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 30 33 39 62 3a 38 62 39 62 63 31 66 64 22 29 3b 76 61 72 20 69 3d 74 Data Ascii: d("mouseenter.slick",function(){_i_("039b:eb68020a"),i.paused=!0,i.autoPlayClear(),_r_()}).bind("mouseleave.slick",function(){_i_("039b:5e48df25"),i.paused=!1,i.autoPlay(),_r_()}),_r_()},r.prototype.initializeEvents=function(){_i_("039b:8b9bc1fd");var i=t
2024-01-15 23:16:23 UTC	2410	IN	Data Raw: 30 21 3d 3d 69 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 2e 74 6f 75 63 68 65 73 3f 69 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 2e 74 6f 75 63 68 65 73 2e 6c 65 6e 67 74 68 3a 31 2c 65 2e 74 6f 75 63 68 4f 62 6a 65 63 74 2e 6d 69 6e 53 77 69 70 65 3d 65 2e 6c 69 73 74 57 69 64 74 68 2f 65 2e 6f 70 74 69 6f 6e 73 2e 74 6f 75 63 68 54 68 72 65 73 68 6f 6c 64 2c 69 2e 64 61 74 61 2e 61 63 74 69 6f 6e 29 7b 63 61 73 65 22 73 74 61 72 74 22 3a 65 2e 73 77 69 70 65 53 74 61 72 74 28 69 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 6d 6f 76 65 22 3a 65 2e 73 77 69 70 65 4d 6f 76 65 28 69 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 65 6e 64 22 3a 65 2e 73 77 69 70 65 45 6e 64 28 69 29 7d 5f 72 5f 28 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 73 77 69 70 65 4d 6f 76 65 3d Data Ascii: 0!==i.originalEvent.touches?i.originalEvent.touches.length:1,e.touchObject.minSwipe=e.listWidth/e.options.touchThreshold,i.data.action){case"start":e.swipeStart(i);break;case"move":e.swipeMove(i);break;case"end":e.swipeEnd(i)}_r_()},r.prototype.swipeMove=
2024-01-15 23:16:23 UTC	1538	IN	Data Raw: 32 32 38 62 31 22 29 3b 74 68 69 73 2e 64 65 73 74 72 6f 79 28 29 2c 5f 72 5f 28 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 75 70 64 61 74 65 41 72 72 6f 77 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 30 33 39 62 3a 63 35 32 32 37 34 38 33 22 29 3b 76 61 72 20 69 3d 74 68 69 73 3b 4d 61 74 68 2e 66 6c 6f 6f 72 28 69 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 2f 32 29 2c 21 30 3d 3d 3d 69 2e 6f 70 74 69 6f 6e 73 2e 61 72 72 6f 77 73 26 26 21 30 21 3d 3d 69 2e 6f 70 74 69 6f 6e 73 2e 69 6e 66 69 6e 69 74 65 26 26 69 2e 73 6c 69 64 65 43 6f 75 6e 74 3e 69 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 26 26 28 69 2e 24 70 72 65 76 41 72 72 6f 77 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 73 6c 69 63 6b 2d 64 69 Data Ascii: 228b1");this.destroy(),_r_()},r.prototype.updateArrows=function(){_i_("039b:c5227483");var i=this;Math.floor(i.options.slidesToShow/2),!0===i.options.arrows&&!0!==i.options.infinite&&i.slideCount>i.options.slidesToShow&&(i.$prevArrow.removeClass("slick-di

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.5	49908	142.251.167.100	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:23 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:23 UTC	463	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:23 GMT Expires: Mon, 15 Jan 2024 23:46:23 GMT Cache-Control: public, max-age=1800 Server: sffe Content-Length: 251 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.5	49911	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2443	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1369 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedpAqJTi0BVFp6fwmpts3dzlzwvQzO7v%2B2nXdY5KTBJcsRptY6RLggOawcCnJZDdVACmED0vog7L4RcvyMbqIyiaLIlg6BOOd3yU4HKNbPy7l5Dg13GfNy%2Bz%2BJbrbdAVOjxxiKcJV944Jn4ZRsLABnmfRn7YxNfpoE%3D
2024-01-15 23:16:24 UTC	1369	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 68 65 61 64 65 72 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 73 75 62 68 65 61 64 65 72 22 2c 22 Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"genius_sign_in_banner","design_variant":"genius_sign_in_banner","title":"gex_w_index_white_banner_header","subtitle":"gex_w_index_white_banner_subheader","
2024-01-15 23:16:24 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EtKvv738sAcAwlnj4uNBezHeD%2FMUsNpL2p2b2FGAiUdTz7OBA1aTCdgTYuRlZzc3FtbNKtZ0eJGjlpate4Hh5GQI6tRbZlkZBc%2BOxuOE7DEGxrKdoV4FKB0; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9c9ba3a4fc7a011e&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqss98rEy4OFI5vRAi5cCuvanRS7Uh1cC2T0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7b32163caf7e91fe96df7bbeaa58c0f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ckHCi0LmMiPn4f8TR_2dZ3-nlR9TrfWhBDXRxA4tmc_PkxERnXJkqg==
2024-01-15 23:16:24 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.5	49914	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 810 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:24 UTC	810	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 62 61 6e 6e 65 72 5f 61 63 74 69 6f 6e 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 69 6e 64 65 78 22 3a 30 2c 22 61 63 74 69 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 62 6f 6f 6b 69 6e 67 2d 68 6f 6d 65 2f 69 6e 64 65 78 2e 65 6e 2d 75 73 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"booking_home","design_variant":"booking_home","banner_action":[{"action_index":0,"action_url":"https://www.booking.com/booking-home/index.en-us.html?aid=30
2024-01-15 23:16:24 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeefcvfa5ov4omU5h%2FFR9VlguaaYY%2FJWvlLx2v69p8JTZN%2FUtqs0bqjE6DG%2B0hXZoiDKshY1AdZG8Zaw%2B6VTXjhK0AADhOjWH221qJnakS4jeHNrfbPqm8xa600vXc1k%2F0czTL67GZLCbdwnUHZ56luKOO7MzNeXSPg%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=32eba3a4788700eb&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvQy-GfH2TYCjfgfhH8wU2dITgppm4uFB8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A8_VEZ82PXFhK49HiUIZ3Vuu_6WumThceoG-S-lFN0qIIxmThIfEeQ==
2024-01-15 23:16:24 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.5	49912	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2722	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:24 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-01-15 23:16:24 UTC	1101	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPef4Ce%2Fm%2BKwu%2FRG7Dfj5koVRWpDtwwufFz0A3S0Xz6yz0CDpjVuc8l4QF%2Fckb%2B68iqol1jxRUMoWVRG0vrEJnUIXNKmGt%2ByGrPwnH7cVxAK1hLCYg%2FewysHLgvARwXmfGE8QuLsWbbeJKgoszcTfmNIC3ggUkorUEoQ%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7a62a3a464da0047&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcVui47o2KSvzPgnPq5EbBtjMCV8ZDbenQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Y6oIMBD8pIvWYKuwNEGH1YAjyU6K83ZLqj51iGrt0O8QRP3GWS0PKw==
2024-01-15 23:16:24 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 61 70 70 6c 69 65 64 44 69 Data Ascii: {"data":{"trackAdStatus":{"directives":[],"allAppliedDirectivesByName":{},"coercing":{},"extensionDefinitions":[],"name":"JSON","childrenWithTypeReferences":{"children":{"appliedDirectives":[],"directives":[]},"empty":false,"childrenAsList":[]},"appliedDi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.5	49909	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2824	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-site-type-id: 1 x-booking-pageview-id: d7cca39c07340212 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:24 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-01-15 23:16:24 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BxjK05CTPpkwYxP5NoZTgGiBSC7mU0z%2F7MDsU4TUskewdXoKRKYpOG8sTyKhjty%2FSEQAf8cd2Hle9UCKDHj4WfWJK9ehTuESvaGOnArTraydwoHSabF5g%2B0INgVyax3ZRWEhSnRr52cJzHcVN1khp%2FqeuiP9NdJTw%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=70eca3a424cb062f&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGSgUGaf2SeP3uS-Xxu-ybC6kBz6Lig-6eQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: quV_fxLDSt2-cAm3QHDJ6dXah4iQKO7wxFpeYBiFs_UoJrhwMHY38A==
2024-01-15 23:16:24 UTC	15285	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 2c 22 68 65 61 64 69 6e 67 22 3a 22 42 72 6f 77 73 65 20 62 79 20 70 72 6f 70 65 72 74 79 20 74 79 70 65 22 2c 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 70 72 69 63 65 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 74 69 74 6c 65 22 3a 22 48 6f 74 65 6c 73 22 2c 22 65 78 74 Data Ascii: {"data":{"merchComponentsData":{"components":[{"__typename":"MerchCarousel","subHeading":null,"carouselCampaignId":"de870e3a-ba91-4605-9bb1-61ead1afc684","heading":"Browse by property type","designVariant":{"priceText":null,"items":[{"title":"Hotels","ext
2024-01-15 23:16:24 UTC	1047	IN	Data Raw: 6c 2c 22 65 78 74 72 61 53 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 74 69 74 6c 65 22 3a 22 53 65 6c 66 2d 63 61 74 65 72 69 6e 67 20 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 69 74 65 6d 49 64 22 3a 22 38 37 36 30 30 63 32 63 2d 30 35 32 38 2d 34 30 63 65 2d 61 37 61 65 2d 66 31 36 63 36 62 30 33 39 63 61 66 22 7d 2c 7b 22 73 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 69 74 65 6d 49 64 22 3a 22 35 32 61 65 34 66 30 64 2d 37 61 39 31 2d 34 33 63 66 2d 39 36 63 34 2d 36 35 34 63 63 64 63 39 61 34 39 63 22 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 65 78 74 72 61 53 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 74 69 74 6c 65 22 3a 22 54 69 6e 79 20 68 6f 75 73 65 73 22 2c 22 70 72 69 63 65 22 3a 6e 75 6c 6c 2c Data Ascii: l,"extraSubtitle":"","title":"Self-catering Accommodations","subtitle":"","itemId":"87600c2c-0528-40ce-a7ae-f16c6b039caf"},{"subtitle":"","itemId":"52ae4f0d-7a91-43cf-96c4-654ccdc9a49c","filters":null,"extraSubtitle":"","title":"Tiny houses","price":null,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.5	49913	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2824	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-site-type-id: 1 x-booking-pageview-id: d7cca39c07340212 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:24 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-01-15 23:16:24 UTC	1096	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATJLrRC1G7gD8Emo%2F3gp29kOH7KSUddRQvNbFJkMkuXCNuYomwhqmoLZVRwnVlkuZDoR9aS2jI2aH7UtB2YKB%2B5bizyuzTYFTlXDgPF88ESTUjgmR4XfjJKm%2BzGsSUvAp36A0TBveEVS0%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1c6aa3a4f3c7013a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZrdZD2IRE3BiJQ6T6GH-wR3KWDc219RPw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: krwK-HWrdRZWhPQzWyzXuathnVXYuIQkrHA2QBGi1Bi6HVSmxNtngQ==
2024-01-15 23:16:24 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 2c 22 66 69 6c 74 65 72 73 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 22 54 68 65 73 65 20 70 6f 70 75 6c 61 72 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 68 61 76 65 20 61 20 6c 6f 74 20 74 6f 20 6f 66 66 65 72 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 68 65 61 64 69 6e 67 22 3a 22 45 78 70 6c 6f 72 65 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d Data Ascii: {"data":{"merchComponentsData":{"components":[{"carouselCampaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32cad","filtersInfo":null,"subHeading":"These popular destinations have a lot to offer","__typename":"MerchCarousel","heading":"Explore United States of Am

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.5	49910	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	2722	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 540 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:24 UTC	540	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 63 61 6d 70 61 69 67 6e 49 64 5c 6e 20 20 20 20 63 61 72 6f 75 73 65 6c 4e 61 6d 65 5c 6e 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 73 75 62 74 69 74 6c 65 5c 6e 20 20 20 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 20 20 69 6d 61 67 65 55 72 6c 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 64 69 73 74 61 Data Ascii: {"operationName":"TripTypeDestinations","variables":{},"extensions":{},"query":"query TripTypeDestinations {\n tripTypeDestinations {\n campaignId\n carouselName\n title\n subtitle\n destinations {\n imageUrl\n title\n dista
2024-01-15 23:16:24 UTC	1094	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 38 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:24 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:24 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1019a3a4737300b5&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGclS9YPd5MxqoCh97R9Y02l42L6MCefwBA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: iHXy-XcbiO8JWx_IPqfv8YEuwWH1wsOd4ULTYMbEZBIvVVYS9rl6Jw==
2024-01-15 23:16:24 UTC	38	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 3a 6e 75 6c 6c 7d 7d Data Ascii: {"data":{"tripTypeDestinations":null}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.5	49921	142.251.163.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	651	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: application/json Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 Date: Mon, 15 Jan 2024 23:16:25 GMT Expires: Tue, 16 Jan 2024 23:16:25 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:25 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.5	49922	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:24 UTC	1016	OUT	POST /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=1523317164.1705360584&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:25 UTC	818	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:25 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=1523317164.1705360584&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:25 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.5	49938	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2824	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-site-type-id: 1 x-booking-pageview-id: d7cca39c07340212 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 30 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":60}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.5	49935	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2583 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	2583	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 64 33 69 69 67 56 41 76 41 41 41 41 3a 42 6a 6a 65 57 6b 4b 54 78 59 6e 52 79 2f 65 32 32 44 73 38 66 2f 69 77 5a 57 69 57 70 75 47 33 7a 75 70 4f 31 77 74 52 5a 6b 71 44 53 74 63 6c 78 4f 53 4f 5a 33 49 32 31 55 36 61 66 6c 76 6a 63 45 44 61 42 4b 46 39 49 46 35 36 61 41 6b 43 6a 54 6f 45 69 68 41 78 4b 73 49 4b 34 70 6f 65 39 56 37 56 30 2f 42 4b 30 33 6b 42 49 44 34 58 69 45 68 4f 30 4d 44 37 75 78 71 68 56 6b 66 59 32 46 45 33 43 64 6e 6f 75 6a 42 31 43 45 31 6f 6c 57 33 35 39 2b 43 44 33 57 2f 53 50 43 47 68 43 4f 66 61 55 75 31 49 35 5a 4a 76 76 79 75 69 68 52 53 58 44 4a Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJ
2024-01-15 23:16:25 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1212 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:25 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcc9-5e6a63ef17cfbcb422a4bfa0 X-Cache: Miss from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: iGc_Xg00kkuqRd3j2nAhlyVmM4xEHfp44DW4hwHRtLR4-_Z6lkTF2Q==
2024-01-15 23:16:25 UTC	1212	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 74 52 4b 69 45 75 51 38 41 41 41 41 3a 48 6e 70 72 41 65 41 4d 43 73 49 32 69 43 57 4b 2f 6a 4f 6f 74 32 75 4d 61 34 62 33 38 6f 72 49 4e 53 52 30 38 77 7a 4f 37 70 2b 70 64 57 6c 65 57 68 39 35 4c 39 77 56 79 44 4c 50 73 36 5a 56 73 73 6a 6b 57 56 51 6c 74 4e 6c 53 41 4e 34 46 7a 6a 71 50 61 43 62 5a 52 46 72 33 68 75 41 68 4e 4b 65 69 49 33 38 30 74 31 6b 70 69 31 58 36 36 6c 54 4f 35 50 54 38 76 43 69 4b 36 6b 52 6c 78 56 39 6c 73 2b 72 46 64 4b 57 75 59 35 76 4d 64 66 38 4d 79 78 79 41 78 48 78 76 77 56 30 47 76 42 61 50 46 4b 79 41 75 65 78 78 5a 46 65 7a 39 62 31 48 38 36 45 34 6c 73 52 61 73 72 62 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86E4lsRasrb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.5	49937	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2824	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1794 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-site-type-id: 1 x-booking-pageview-id: d7cca39c07340212 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	1794	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 2c 22 64 61 74 65 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 32 30 32 34 2d 30 31 2d 31 35 22 2c 22 63 68 65 63 6b 6f 75 74 22 3a 22 32 30 32 34 2d 30 31 2d 31 36 22 7d 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2,"dates":{"checkin":"2024-01-15","checkout":"2024-01-16"}},"acidCarouselContext":{"acidCarouselId":67}}},"extensions":{},"query":"query AcidCarouselSearch($input:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.5	49936	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2824	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-site-type-id: 1 x-booking-pageview-id: d7cca39c07340212 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 35 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":57}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.5	49946	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 477 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	477	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 64 33 34 37 39 35 63 2d 61 38 38 30 2d 34 35 34 38 2d 62 64 37 38 2d 65 35 36 66 66 35 66 61 39 37 33 33 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 Data Ascii: {"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"0d34795c-a880-4548-bd78-e56ff5fa9733"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booking.com \| Official sit
2024-01-15 23:16:25 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:25 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBI9EWd%2FKX1FgSFzfvOkDh0pDzLXxgZmKKMqR7KWwaCperLYAX3pziKYv5YusxMTaEuxQBjhkyfADzPutztf3Dg%2FrCZuOWvzZuqADhmspcKjFqj2C9M2W%2F7Khui1rAX6vmRqV2pyVJcZVR6pHyl%2Fm5gD0FOUQNgcMLY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:25 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5c2aa3a4c89d00b0&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu5rsOk919U1dx8RqZcU5lWznh0N6hQ9O8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ygeWnIlYGbY8cCii_mfWIjgirwuwwxOPRxcrnqHVx5s0hqlfeh-KeQ==
2024-01-15 23:16:25 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.5	49944	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 495 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	495	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 32 62 39 33 31 32 31 2d 63 66 66 33 2d 34 34 33 35 2d 61 63 33 61 2d 36 65 61 65 63 36 30 31 65 35 36 30 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"02b93121-cff3-4435-ac3a-6eaec601e560"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booking.
2024-01-15 23:16:25 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:25 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2By2J%2FZK%2BbdQ6E%2FBkA81cRrFb1uOxIP9kmxzaHDGm09%2FyK6jLFbOpfsSU5rIM6kNgZRpCOqeQppZewu5cMH1ZMutbpJcTM8RYeM0TvfoQtjYw5O9BwjBUqPXDMR546UfuGuGomUytCJChP35fakd4SWTsbMBtP%2FJOo%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:25 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2d6ba3a46e490423&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssF0_d8yO3IS2BmcZD0IfhRdOLjqxjX-pA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A7i9aBf2Mze0lnx7qCqXKZppwzIBDK2vvPId6SZZRuTkKZUKkBQQ1Q==
2024-01-15 23:16:25 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.5	49939	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 495 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	495	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 66 65 38 63 66 36 2d 31 63 38 39 2d 34 66 35 37 2d 39 62 38 65 2d 64 64 62 31 30 62 35 64 30 62 66 63 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"32fe8cf6-1c89-4f57-9b8e-ddb10b5d0bfc"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booking.
2024-01-15 23:16:25 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:25 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBK6LEtX6%2Blc%2BZOcLL%2F5UTQE7RSXe5TOD8YAwAJQ2prrtx%2FEhj8e7CPVGy9ftqeAieqy0WGDTXV1ql9yxNB3JVb0k%2FyZSpG8jPEWn%2FDQvN6D61e6riMBAC5Clsubp6lbqLdjwwOatSzrGaPS4Athivt39a8JwtgsiX8%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:25 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1879a3a4cbe300b9&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuko3gqgycvX5WTnkPrBvuh0idZcvxBUGM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: QgetWKyTci5EXzpKrLDVT38PqwewVYsoBZUguV5a_Xxg9cqxpmTZUQ==
2024-01-15 23:16:25 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.5	49918	142.250.31.132	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 22b7de70070b66a71431259564d59756.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Mon, 15 Jan 2024 23:16:25 GMT Expires: Tue, 14 Jan 2025 23:16:25 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:25 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-01-15 23:16:25 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-01-15 23:16:25 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-01-15 23:16:25 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-01-15 23:16:25 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-01-15 23:16:25 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.5	49933	146.75.28.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	521	OUT	GET /ct/core.js HTTP/1.1 Host: s.pinimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	453	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4643 ETag: "13732720bdb48cc3c14028344351272b" x-amz-server-side-encryption: AES256 Content-Type: application/javascript X-CDN: fastly alt-svc: h3=":443";ma=600 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Access-Control-Expose-Headers: X-CDN Vary: Accept-Encoding, Origin Cache-Control: max-age=7200 date: Mon, 15 Jan 2024 23:16:25 GMT
2024-01-15 23:16:25 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 28 69 5b 6e 5d 7c 7c 28 65 3d 69 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 5b 6e 5d 2e 63 61 6c 6c 28 65 2e 65 78 70 6f 72 74 73 2c 65 2c 65 2e 65 78 70 6f 72 74 73 2c 72 29 2c 65 2e 6c 3d 21 30 2c 65 29 29 2e 65 78 70 6f 72 74 73 7d 72 2e 6d 3d 74 2c 72 2e 63 3d 69 2c 72 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 72 2e 6f 28 6e 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 6e 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 74 7d 29 7d 2c 72 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 6e 64 65 66 69 6e Data Ascii: !function(t){var i={};function r(n){var e;return(i[n]\|\|(e=i[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,r),e.l=!0,e)).exports}r.m=t,r.c=i,r.d=function(n,e,t){r.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},r.r=function(n){"undefin
2024-01-15 23:16:25 UTC	1378	IN	Data Raw: 6c 6c 28 6e 29 2e 73 6c 69 63 65 28 38 2c 2d 31 29 29 26 26 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3f 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 29 7c 7c 22 53 65 74 22 3d 3d 3d 74 3f 41 72 72 61 79 2e 66 72 6f 6d 28 6e 29 3a 22 41 72 67 75 6d 65 6e 74 73 22 3d 3d 3d 74 7c 7c 2f 5e 28 3f 3a 55 69 7c 49 29 6e 74 28 3f 3a 38 7c 31 36 7c 33 32 29 28 3f 3a 43 6c 61 6d 70 65 64 29 3f 41 72 72 61 79 24 2f 2e 74 65 73 74 28 74 29 3f 69 28 6e 2c 65 29 3a 76 6f 69 64 20 30 7d 28 6e 2c 65 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 64 65 73 74 72 75 63 74 75 72 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e Data Ascii: ll(n).slice(8,-1))&&n.constructor?n.constructor.name:t)\|\|"Set"===t?Array.from(n):"Arguments"===t\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(t)?i(n,e):void 0}(n,e)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.
2024-01-15 23:16:25 UTC	1378	IN	Data Raw: 65 7c 7c 30 29 26 26 72 2e 76 28 6e 29 7d 72 2e 73 65 74 56 65 72 73 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6f 3d 6e 7d 2c 72 2e 76 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 31 2c 65 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 20 6d 65 73 73 61 67 65 20 66 61 69 6c 65 64 20 74 6f 20 73 65 6e 64 22 29 7d 2c 65 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 22 68 74 74 70 73 3a 2f 2f 63 74 2e 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 2f 73 74 61 74 73 2f 22 2c 21 31 29 2c 65 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f Data Ascii: e\|\|0)&&r.v(n)}r.setVersion=function(n){o=n},r.v=function(n){var e=new window.XMLHttpRequest;e.withCredentials=!1,e.onerror=function(){console.error("Error message failed to send")},e.open("POST","https://ct.pinterest.com/stats/",!1),e.setRequestHeader("Co
2024-01-15 23:16:25 UTC	509	IN	Data Raw: 64 55 52 49 26 26 22 68 74 74 70 73 3a 2f 2f 73 2e 70 69 6e 69 6d 67 2e 63 6f 6d 2f 63 74 2f 6c 69 62 2f 6d 61 69 6e 2e 34 33 63 30 30 39 35 63 2e 6a 73 22 3d 3d 3d 6e 2e 62 6c 6f 63 6b 65 64 55 52 49 26 26 28 65 3d 22 44 69 72 65 63 74 69 76 65 3a 20 22 2b 6e 2e 65 66 66 65 63 74 69 76 65 44 69 72 65 63 74 69 76 65 2b 22 20 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 22 2b 6e 2e 64 69 73 70 6f 73 69 74 69 6f 6e 2b 22 20 42 6c 6f 63 6b 65 64 20 55 52 49 3a 20 22 2b 6e 2e 62 6c 6f 63 6b 65 64 55 52 49 2c 6e 2e 6f 72 69 67 69 6e 61 6c 50 6f 6c 69 63 79 3f 28 74 3d 69 2e 68 28 6e 2e 6f 72 69 67 69 6e 61 6c 50 6f 6c 69 63 79 29 29 26 26 30 3c 74 2e 6c 65 6e 67 74 68 3f 28 65 2b 3d 22 20 6d 61 69 6e 20 66 69 6c 65 28 73 29 20 61 6c 6c 6f 77 65 64 3a 20 22 2b 74 2e Data Ascii: dURI&&"https://s.pinimg.com/ct/lib/main.43c0095c.js"===n.blockedURI&&(e="Directive: "+n.effectiveDirective+" Disposition: "+n.disposition+" Blocked URI: "+n.blockedURI,n.originalPolicy?(t=i.h(n.originalPolicy))&&0<t.length?(e+=" main file(s) allowed: "+t.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.5	49934	3.162.129.245	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	526	OUT	GET /scevent.min.js HTTP/1.1 Host: sc-static.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	662	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 42390 Connection: close Server: CloudFront Date: Mon, 15 Jan 2024 23:16:25 GMT Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Origin: * Content-Encoding: utf-8 Cache-Control: private, s-maxage=0, max-age=600 Set-Cookie: X-AB=dc4e3509882e40c68a170453af779220;max-age=86400;expires=Tue, 16 Jan 2024 23:16:25 GMT;Path=/scevent.min.js;Secure;SameSite=None X-Cache: Miss from cloudfront Via: 1.1 795b4b6b943fe3d87b1c7e104dc9034c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: LOWGxCmi69v4o2P_LJ5jgZsia6w90NWGidmDL9EEOZ75NkzG-z1mAg==
2024-01-15 23:16:25 UTC	15722	IN	Data Raw: 2f 2a 2a 20 53 6e 61 70 63 68 61 74 20 50 69 78 65 6c 20 53 44 4b 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 2c 72 3d 31 2c 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 3c 65 3b 72 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 69 29 26 26 28 6e 5b 69 5d 3d 74 5b 69 5d 29 3b 72 65 74 75 72 6e 20 6e 7d 2c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 Data Ascii: /** Snapchat Pixel SDK */!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,argu
2024-01-15 23:16:25 UTC	16384	IN	Data Raw: 72 69 6e 67 69 66 79 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 72 65 74 75 72 6e 20 63 28 72 29 3f 66 28 74 2c 72 29 3f 76 6f 69 64 20 30 3a 28 4f 28 74 2c 72 29 2c 72 29 3a 72 7d 29 29 7d 63 61 74 63 68 28 6e 29 7b 77 6e 28 22 4a 53 4e 22 2c 6e 29 7d 74 72 79 7b 69 66 28 63 28 6e 29 26 26 21 66 28 74 2c 6e 29 29 7b 4f 28 74 2c 6e 29 3b 76 61 72 20 72 3d 22 22 3b 69 66 28 54 28 6e 2e 74 6f 4a 53 4f 4e 29 29 72 65 74 75 72 6e 20 50 72 28 6e 2e 74 6f 4a 53 4f 4e 28 29 29 3b 69 66 28 6f 28 6e 29 29 7b 66 6f 72 28 76 61 72 20 65 3d 44 28 6e 29 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 7b 72 2b 3d 28 69 3f 22 2c 22 3a 22 22 29 2b 28 28 73 3d 50 72 28 6e 5b 69 5d 29 29 7c 7c 22 6e 75 6c 6c 22 29 7d 72 65 74 75 72 6e 22 5b 22 2b 72 2b 22 5d 22 7d 69 3d Data Ascii: ringify(n,(function(n,r){return c(r)?f(t,r)?void 0:(O(t,r),r):r}))}catch(n){wn("JSN",n)}try{if(c(n)&&!f(t,n)){O(t,n);var r="";if(T(n.toJSON))return Pr(n.toJSON());if(o(n)){for(var e=D(n),i=0;i<e;i++){r+=(i?",":"")+((s=Pr(n[i]))\|\|"null")}return"["+r+"]"}i=
2024-01-15 23:16:25 UTC	10284	IN	Data Raw: 7c 5b 22 31 22 5d 29 2c 68 3d 44 28 5f 29 2c 79 3d 30 3b 79 3c 68 3b 79 2b 2b 29 74 5b 70 5d 3d 28 74 5b 70 5d 3f 74 5b 70 5d 2b 22 2c 22 3a 22 22 29 2b 5f 5b 79 5d 3b 65 6c 73 65 20 74 5b 70 3d 75 2e 72 65 70 6c 61 63 65 28 22 5f 22 2c 22 5f 68 22 29 5d 3d 28 74 5b 70 5d 3f 74 5b 70 5d 2b 22 2c 22 3a 22 22 29 2b 58 72 28 6c 29 7d 7d 63 61 74 63 68 28 6e 29 7b 77 6e 28 22 41 53 43 50 4d 22 2c 6e 29 7d 44 28 6e 6e 28 74 29 29 3e 31 26 26 41 6e 28 7b 70 63 3a 74 7d 29 7d 28 6e 29 7d 29 29 29 2c 21 21 74 7d 63 61 74 63 68 28 74 29 7b 77 6e 28 22 41 4d 41 4c 22 2c 74 2c 6e 2e 77 61 74 63 68 5f 65 6c 29 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 53 69 28 6e 29 7b 74 72 79 7b 69 66 28 21 6d 69 28 6e 29 29 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: \|["1"]),h=D(_),y=0;y<h;y++)t[p]=(t[p]?t[p]+",":"")+_[y];else t[p=u.replace("_","_h")]=(t[p]?t[p]+",":"")+Xr(l)}}catch(n){wn("ASCPM",n)}D(nn(t))>1&&An({pc:t})}(n)}))),!!t}catch(t){wn("AMAL",t,n.watch_el)}return!0}function Si(n){try{if(!mi(n))var t=function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.5	49928	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	1217	OUT	GET /pagead/viewthroughconversion/988382855/?random=1705360583484&cv=11&fst=1705360583484&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	842	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:25 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Mon, 15-Jan-2024 23:31:25 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:25 UTC	410	IN	Data Raw: 39 30 35 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 905(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:25 UTC	1252	IN	Data Raw: 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b 20 61 3b 61 3d 22 22 7d 72 65 74 75 72 6e 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 79 28 29 7b 72 65 74 75 72 6e 20 67 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 Data Ascii: 1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("S
2024-01-15 23:16:25 UTC	654	IN	Data Raw: 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 63 58 68 69 58 30 4e 4c 54 47 4a 79 57 55 46 45 52 55 6c 6c 54 6e 42 30 59 30 51 36 4d 54 63 77 4e 54 4d 32 4d 44 55 34 4d 7a 51 34 4e 41 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 61 67 65 61 64 2f 31 70 2d 75 73 65 72 2d 6c 69 73 74 2f 39 38 38 33 38 32 38 35 35 2f 3f 72 61 6e 64 6f 6d 5c 78 33 64 31 37 30 35 33 36 30 35 38 33 34 38 34 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 Data Ascii: ).call(this);;s.ss_(window,'cXhiX0NLTGJyWUFERUllTnB0Y0Q6MTcwNTM2MDU4MzQ4NA',['https://www.google.com/pagead/1p-user-list/988382855/?random\x3d1705360583484\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v
2024-01-15 23:16:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.5	49947	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	1275	OUT	GET /activity;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	1307	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:25 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.5	49945	172.253.63.138	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	641	OUT	HEAD /about/enterprise/ HTTP/1.1 Host: marketingplatform.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:25 UTC	887	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Content-Length: 125161 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/marketing_platform Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/marketing_platform" Report-To: {"group":"uxe-owners-acl/marketing_platform","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/marketing_platform"}]} Date: Mon, 15 Jan 2024 23:16:25 GMT Expires: Mon, 15 Jan 2024 23:16:25 GMT Cache-Control: private, max-age=3000 Last-Modified: Tue, 09 Jan 2024 09:58:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.5	49949	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 532 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	532	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 64 65 73 74 69 6e 61 74 69 6f 6e 5f 72 65 63 6f 6d 6d 65 6e 64 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 6f 73 74 63 61 72 64 73 22 3a 5b 7b 22 75 66 69 22 3a 32 30 30 32 33 34 38 38 7d 2c 7b 22 75 66 69 22 3a 32 30 30 38 38 33 32 35 7d 2c 7b 22 75 66 69 22 3a 32 30 30 37 39 31 31 30 7d 2c 7b 22 75 66 69 22 3a 32 30 30 32 34 38 30 39 7d 2c 7b 22 75 66 69 22 3a 32 30 30 31 34 31 38 31 7d 5d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: {"action_name":"webcoreux.destination_recommender_viewed","action_version":"1.0.0","content":{"postcards":[{"ufi":20023488},{"ufi":20088325},{"ufi":20079110},{"ufi":20024809},{"ufi":20014181}]},"context":{"page":{"page_referrer":"","page_url":"https://www
2024-01-15 23:16:26 UTC	1173	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhCYiP4tlENZkFSry6iGracfRQv2%2FP7453e6N2QRNLb0j7ADn7cf1xoV98bJ1rNzGqY0bRDnFPM7FBbs8XfR1NaZrNrLeh1keYC6rzR%2B2uuV8VxidZ3nB9xLZzgLjrXyZFcvZufaQHHdP3D95ASpNEVisuNL2tozycQ%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:26 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=490ea3a563640182&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsumcpzD1aLrr8Qf9EOVr8OqFiaEeaIJlSE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: y6cYAVjfQpV8U26Tn6VPm5SzGyYC9bihqwdp1oP6bq41Icu9U5FOng==
2024-01-15 23:16:26 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.5	49948	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2439	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 505 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	505	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 64 37 63 63 61 33 39 63 30 37 33 34 30 32 31 32 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 31 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 33 32 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 36 35 35 33 39 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 36 37 37 37 34 25 32 43 31 37 30 35 33 36 30 35 36 37 37 37 36 25 32 43 31 37 30 35 33 36 30 35 36 37 38 37 34 25 32 43 31 37 30 35 33 36 30 35 36 37 38 37 34 25 32 43 31 37 30 35 33 36 30 35 36 38 30 38 34 25 32 43 31 37 30 35 33 36 30 35 36 37 38 37 35 25 32 43 31 37 30 35 33 36 30 35 Data Ascii: ref_action=index&pid=d7cca39c07340212&stype=1&lang=en&first=1&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=32&nts=0%2C0%2C1705360565539%2C0%2C0%2C0%2C0%2C1705360567774%2C1705360567776%2C1705360567874%2C1705360567874%2C1705360568084%2C1705360567875%2C17053605
2024-01-15 23:16:26 UTC	1030	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VFl5riwFpZJpO6WBUcDkL0C1mJiWWaWJFupGf9nbAHzg5kJb2oBHUSqVMUhl12q%2BCeM25mUQ4sC%2F77hHTmQZX96jUcAdP5LJPtSwQqA9z9af59P%2FLaqP14hLppC6SUiMJgoKjDCaUjeUZNcMEJ1XNdE%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:26 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=04dba3a5b7510192&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJs5ApCFRoJ9NERs1kS-kvR6wQwHfc8huQU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: IzWDVi1luKhkV83LiqHCDgjvE9ISBhxBSvJ69-N5Uqqq14iJ_MT08Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.5	49950	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:25 UTC	2722	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:25 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-01-15 23:16:26 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 368 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55qZ0yAR7Q79jyBG3erEaHys1qPs0QNVUWTJSQTiIbRDfcSz%2Fi6DE7TP4JxxtkFL1wcA6EXMumkmckbI9FDK5KLGjc8Hi5bJSKS4cOBsatUTd8%2BK6OsqUVxwlKfK%2FcrEfiM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:26 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=134ea3a56c8c015a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGa65MnEJp_ZJyIWpzfw2uYMhH_3O51iPyA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 9LIwBuQx1ETtYv9him_z09Ilps64bcuLX2iJBLEJFxz0NrDB4H93xg==
2024-01-15 23:16:26 UTC	368	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 2c 22 63 6c 6f 73 65 41 72 69 61 4c 61 62 65 6c 22 3a 22 44 69 73 6d 69 73 73 20 73 69 67 6e 2d 69 6e 20 69 6e 66 6f 2e 22 2c 22 74 69 74 6c 65 22 3a 22 53 69 67 6e 20 69 6e 2c 20 73 61 76 65 20 6d 6f 6e 65 79 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 5b 22 53 69 67 6e 20 69 6e 20 74 6f 20 5b 73 74 61 72 74 5f 62 6f 6c 64 5d 73 61 76 65 20 31 30 25 20 6f 72 20 6d 6f 72 65 5b 65 6e 64 5f 62 6f 6c 64 5d 20 77 69 74 68 20 61 20 66 72 65 65 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 6d 65 6d 62 65 72 73 68 69 Data Ascii: {"data":{"geniusGuestData":{"signInBottomSheet":{"__typename":"GeniusSignInBottomSheet","closeAriaLabel":"Dismiss sign-in info.","title":"Sign in, save money","subtitle":["Sign in to [start_bold]save 10% or more[end_bold] with a free Booking.com membershi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.5	49951	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	444	OUT	GET /xdata/images/city/600x600/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 30 Dec 2023 10:59:20 GMT ETag: "3f8267ebd0508c68e3d519428a7d00fe4c1a2f74" Content-Language: 65913 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d01a0cfc47d6e412dd81c986ff5d69da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9AVo2ONd_nSwH8lA3AWByWuuTYkX4rnfIrI9pc1fEg-5pCqfdz9Fbg== Age: 1426626
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: 31 30 31 37 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 10179JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: 41 1c 1f e5 ef 56 db cf 32 dc 1b 9d 93 44 21 61 95 6c 9e 9c 8c 8e 45 45 0b 2b 45 2f d9 3f 74 db 80 31 bb 71 d1 b8 e7 ae 69 88 b7 6b 7f 7d a7 ac f2 43 2b 88 d5 15 93 04 61 b2 39 e3 fc 73 5d be 89 7d 2e a3 a5 c5 75 28 01 df b0 af 3f 8e 2d bf 6c 78 27 31 cc d1 c7 9d dc 08 ce 06 39 ae e7 c3 3b bf b1 53 7b 06 7d c7 71 18 eb 81 e9 5a 53 bd c9 9a d0 d8 a4 a5 a4 ad 4c c9 6d b3 e7 ae 08 07 b1 35 a2 4a a2 83 87 66 2c 70 3f 89 b8 1f 97 f3 ac eb 7c 89 d7 04 83 cf 20 66 b4 0b 62 2c 2a 92 77 74 cf 27 ea 6b 9e af c4 6b 4f 61 48 fd fa 16 c7 1b 70 bd 14 71 fa 9a 89 4b 3a c9 b4 95 0c 9f 7f b9 e4 70 05 48 54 99 a3 77 23 f8 71 fd d1 c7 6f 5f e5 4c 1b 9b 7e 37 28 61 d7 f8 8f 3f cb f4 ac 8d 0e 37 c7 aa 8b a2 5b 8e 8b f6 83 b8 67 27 ee 37 5a f2 bb 94 8a 36 87 ca 2b 2a 93 91 9e Data Ascii: AV2D!alEE+E/?t1qik}C+a9s]}.u(?-lx'19;S{}qZSLm5Jf,p?\| fb,wt'kkOaHpqK:pHTw#qo_L~7(a?7[g'7Z6+
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: a8 cf e1 5d e6 2b 87 f8 5f ce 85 76 d9 ce 6e 31 9f f8 08 ae e6 99 0f 71 0d 26 29 d4 94 08 6d 18 a5 a3 9a 00 6d 25 2d 21 a6 21 29 29 69 28 01 29 29 4d 25 00 25 25 3a 9b 40 82 b8 8d 78 8b 8d 66 48 84 53 6a 32 a6 0a 5a e7 6c 11 70 30 5c f7 3f 5c fd 2b b6 ce 2b 8a f1 0b 44 fa 94 f0 4f 34 f2 c6 79 fb 15 a8 c1 71 81 93 23 0e 83 f1 03 15 33 d8 a8 ee 67 be 2e ee 04 37 2d 26 a7 3c 6c a0 59 5a fc 96 f0 e3 fb c7 a1 c6 0f 5f ca 96 fa 41 34 52 5b 5f 5d 3d d4 a8 84 2e 9f 60 08 8e 2c 77 72 3a e0 f3 ce 3e 95 97 7f e2 3b 2b 32 2d e7 98 c3 6b bb 3f 66 d3 f0 38 ff 00 69 f2 37 7a 1d bc 1f 5a 8e db c5 1a 75 cd bc d0 5b dd a6 97 6c d9 db 0c 51 13 24 a7 1c 6e 6c 60 7e 79 f7 ac ae 8d 2c 51 8c 5b c3 9d a6 f2 d0 ee e8 d9 c7 5f d4 57 a4 69 ca b2 69 ba 0b 6a 86 59 25 12 21 b5 10 b0 Data Ascii: ]+_vn1q&)mm%-!!))i())M%%%:@xfHSj2Zlp0\?\++DO4yq#3g.7-&<lYZ_A4R[_]=.`,wr:>;+2-k?f8i7zZu[lQ$nl`~y,Q[_WiijY%!
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: f4 07 d7 6d 63 de 14 9b 70 46 7b fc cd 5c cc 56 f2 6e 53 c7 de fe b5 48 5a 33 da 13 85 03 da 9e df d2 99 d3 a5 2b 9d a3 f0 34 08 7b 7f ab 3f 4a c0 f1 0d cc b6 f6 96 d3 43 83 22 4e 19 73 ea 01 22 b7 9c e2 26 3e c6 b0 35 8b 97 b7 4b 39 a2 23 cc 8e 6d cb 9f 50 a6 a2 7b 32 a1 f1 21 23 95 6e bc 54 f0 c9 b0 b3 04 74 f3 17 b2 e7 38 23 df 26 ba 28 a1 8e 32 a1 e4 2e fb c9 00 70 01 db c8 3f 87 d3 af e7 c9 49 77 e5 78 99 a6 9a dd db 60 0e 92 1c 28 1c 1f 4e dd 73 5b da 5d d5 ac 81 10 dc a0 90 e5 d6 2e 84 8c 01 9f d0 9e f5 e7 49 9d f4 e7 16 ec 36 5b bb 78 65 b3 58 ed 31 b8 4c 50 b3 1c c7 b4 73 c7 39 cf 4e 6a fd b3 cd 35 98 20 b4 8e 66 19 c7 cb c0 90 03 8c 76 c0 aa 13 3d 8c 12 da b2 47 33 b2 47 70 d1 06 c6 08 e3 76 ec 8c fa 63 15 3c da ba db c2 89 24 a6 39 9f 2b 11 41 Data Ascii: mcpF{\VnSHZ3+4{?JC"Ns"&>5K9#mP{2!#nTt8#&(2.p?Iwx`(Ns[].I6[xeX1LPs9Nj5 fv=G3Gpvc<$9+A
2024-01-15 23:16:26 UTC	386	IN	Data Raw: 72 e2 05 51 88 42 8c 16 e7 24 9e bd c7 e5 51 cd a6 5b 4c 4b f9 66 39 4f fc b4 8c 94 6f cc 51 45 73 f3 3e 87 42 21 fe cb 27 a5 ed d8 ff 00 81 8f f0 a4 fe cb 61 d3 50 bc 53 ea 19 7f f8 9a 28 a6 e4 ca 23 9e ca e2 48 bc ab 94 b5 d4 a2 c6 0a dc 46 15 b1 ec 70 47 e8 2b 12 ef c3 7e 1e b9 84 c5 35 9c ba 63 fc cc a4 0c 28 62 31 f7 86 41 fa 64 7d 28 a2 b7 a5 56 69 e8 cc 6a e1 e9 cd 7b c8 07 85 ae f4 d1 e7 e9 66 da f1 02 20 1e 68 01 98 03 9d b9 e5 70 4f 35 86 fa 56 b7 10 69 1f 4c 78 e4 0a 49 10 32 b2 b1 cf 6d a7 d0 f4 c1 e9 f9 14 57 47 b4 6d d9 ea 79 b5 30 14 6d 75 a1 5d a1 d4 75 4b 49 21 d4 22 bc b6 28 be 70 69 11 80 0e a0 91 80 54 e7 bf 19 19 cf 5e 05 5b 82 cb 4f b5 b2 65 82 69 2d e7 58 42 46 93 28 7d ce cc 32 72 47 3f 78 f0 3a e3 db 92 8a e8 94 9a d1 6c 79 75 29 Data Ascii: rQB$Q[LKf9OoQEs>B!'aPS(#HFpG+~5c(b1Ad}(Vij{f hpO5ViLxI2mWGmy0mu]uKI!"(piT^[Oei-XBF(}2rG?x:lyu)
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.5	49952	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	444	OUT	GET /xdata/images/city/600x600/976884.jpg?k=00a3546794e9e8cbb86b98371056949ee731002b76358467601e85a0b09dd6db&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 02 Jan 2024 13:55:05 GMT Content-Language: 58584 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "de2a3e99964d447c984a961f27a531cff5636112" X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: w5hDDI2kkeY5Y_WGwIkVvqTuluYzTqcrAdNSHFbFX-bblpOFoWn6OA== Age: 1156881
2024-01-15 23:16:26 UTC	15834	IN	Data Raw: 65 34 64 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: e4d8JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222XX"}!1AQa"q
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: 9f f6 96 ba 2f 11 5f 40 34 d9 2d 91 96 47 90 73 b5 81 db 8e 79 1c fa 56 b1 76 85 8c a4 bd f3 ce 7c 34 72 75 5f a0 ff 00 d9 aa 17 07 64 9b bd 07 f0 e2 a1 f0 e4 c4 6a 17 8a 3a 32 90 79 f6 6a b3 23 0f 29 8e 3b 76 ac 65 b9 aa d8 a3 08 3e 4a 72 c7 e6 e3 e4 1d 31 fe 79 a9 34 65 25 2f 40 52 49 89 b2 be 50 6c fe f0 76 3d 7e 95 1c 2d be 11 d0 91 8f f2 69 da 46 cd 97 e1 80 c1 85 c9 ce 7f e7 a8 f4 a4 05 94 49 b6 49 98 1d 46 c1 80 d6 71 a7 f1 2f f9 c5 07 1b a4 0c a5 48 89 4e e0 c8 9d c7 e5 51 c3 02 79 32 f9 23 e5 28 30 04 2c 4f 55 c7 5a b0 62 74 59 31 04 ad 98 94 71 64 a7 3c 8e 39 eb df 8a 60 5d d0 ce 75 04 d9 23 67 71 c7 99 74 ae a3 e5 6e ab e9 56 35 09 55 05 b6 eb 99 7e 64 c8 68 d7 ef 70 3d 70 45 45 a2 f9 a3 50 0a d6 ef b7 9f f5 96 ab 1a 9f 95 b8 dc 0f 4e 7d 46 2a Data Ascii: /_@4-GsyVv\|4ru_dj:2yj#);ve>Jr1y4e%/@RIPlv=~-iFIIFq/HNQy2#(0,OUZbtY1qd<9`]u#gqtnV5U~dhp=pEEPN}F*
2024-01-15 23:16:26 UTC	16384	IN	Data Raw: e6 d9 58 85 b6 4b 83 26 36 86 42 4a 1e 38 eb fe 73 f4 ab 12 bd b4 96 a5 23 56 46 46 4d b1 33 e7 6f cd cf 61 c6 4f f3 ac 06 99 e2 25 53 cc 42 7a 8e 99 ab d6 21 26 7b 68 e5 8e 70 33 b5 8e 73 bc e7 80 33 d3 ad 6e e2 80 d4 bb b9 08 55 0b 14 f9 71 14 a0 63 0e bd 73 91 c8 e4 8f a9 ae cb c1 da 95 fc a4 59 db 42 6e 61 69 15 e7 25 cf 96 99 04 92 01 1d ce 0f 4c 9c 72 46 79 c8 83 c2 52 eb 77 0a 6d e4 5b 6b 64 e5 9d 9b 79 40 18 63 1c f4 38 3d 7a 63 e9 5d 8e 81 e1 a9 74 7d 41 2e e7 d4 5e 56 da 37 b2 81 c9 f9 b3 c1 07 83 95 e8 41 e0 fa e6 92 b5 86 8d a9 b4 9b 19 49 67 b3 b7 6c fa c2 a7 f9 0a ad 27 87 74 d7 5f 96 ce dd 73 dc 28 07 f5 04 56 f8 9a 39 7a 3a 13 ee a0 13 4d 74 c1 e7 2a 28 71 4f 71 9c c4 9e 0f d3 dc a9 58 15 48 ea 58 67 3f 80 c5 28 f0 ca c0 00 b7 86 25 39 ce Data Ascii: XK&6BJ8s#VFFM3oaO%SBz!&{hp3s3nUqcsYBnai%LrFyRwm[kdy@c8=zc]t}A.^V7AIgl't_s(V9z:Mt*(qOqXHXg?(%9
2024-01-15 23:16:26 UTC	9990	IN	Data Raw: ba 8a 30 ab f4 1f e4 d4 05 c0 a8 da 4c 70 2a 3c 92 79 a0 64 8c e4 d0 17 34 8a b9 1c d3 f2 06 70 28 00 00 2d 31 e5 c0 fe b4 d6 7e 40 19 24 f0 00 a7 e0 40 72 e1 5e 7f ee 9e 56 3f af ab 7b 74 1d eb 39 d4 51 d3 a9 51 8d f5 e8 01 38 12 5c 64 03 ca c6 38 2d ee 7d 05 23 c8 ce 41 7c 70 30 00 18 03 d8 0e c2 9a d2 31 25 89 24 93 92 4f 24 d3 19 b0 09 27 00 54 c6 36 f7 a7 bf e4 36 ef a4 45 2f 80 49 6c 0f 7a c4 d7 f5 fb 6d 2e d3 7c 8e 18 b0 f9 21 1d 64 3f d0 0a ad e2 3f 11 db e9 16 9b 99 77 ce c3 f7 50 93 82 de e7 db fc fb 8f 2e 6d 42 7d 47 52 92 e6 f9 fc d7 27 bf 40 31 c0 03 d0 50 93 a9 e8 37 68 7a 96 67 96 eb 58 d4 cd f5 f3 fc 9c 16 ec 11 7b 00 3b 0f f3 f5 9c 4e b7 25 a2 80 95 81 31 f8 f5 ed 55 ee 63 92 55 8e de 13 81 9c c9 83 d7 df f9 57 7b e1 7f 0c 8b 08 a2 bd ba Data Ascii: 0Lp*<yd4p(-1~@$@r^V?{t9QQ8\d8-}#A\|p01%$O$'T66E/Ilzm.\|!d??wP.mB}GR'@1P7hzgX{;N%1UcUW{
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.5	49953	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2154	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA
2024-01-15 23:16:26 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3085a3a50c02019e&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfzsFMyuy1jVFWu-ZCPNbtWLAhKFF_EgpM x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: l06d70HD0sPwEyvelpFk8jHVVZ4BiAlSwJrGYoyHWlbBuMp1SuDIxQ==
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.5	49956	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2446	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 557 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:26 UTC	557	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 63 72 6f 6c 6c 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 73 65 65 6e 22 3a 5b 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 66 6c 69 67 68 74 73 22 2c 22 70 61 63 6b 61 67 65 73 22 2c 22 63 61 72 73 22 2c 22 63 72 75 69 73 65 73 22 2c 22 61 74 74 72 61 63 74 69 6f 6e 73 22 2c 22 61 69 72 70 6f 72 74 5f 74 61 78 69 73 22 5d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 Data Ascii: {"action_name":"webcoreux.header_component_scrolled","action_version":"1.0.0","content":{"product_verticals_seen":["accommodations","flights","packages","cars","cruises","attractions","airport_taxis"]},"context":{"page":{"page_referrer":"","page_url":"htt
2024-01-15 23:16:26 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:26 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dabca3a523850922&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstYt8mpkff8wD-BSS0zxJ4gXgBsnFquDZ4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: U5FUT-ZVbkoKhAGkBJJie9bXXQml4ZixbMeiJWl2K9SDrvw5bsyNCA==
2024-01-15 23:16:26 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.5	49955	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	3536	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAYWGi8VIcAAAA:Oy5I483r7yFgvv17k354iPLYV2vd/ZnuBDzDKgJy1DLG6T+KTtaTgRACtPQ6MAvg03DbhiAlSSFIaBfr0E16EOpv8rc8WLSZ0fMxNB0hIXF59bTcZJs+j751dVMd+RzF1iL0hYiy2fQy/pwaNXfxBvU1nppEzMtM6X85Kn6gG0/b8uxsjnOhqch08nt+68fjCZI02S1woWDWvkdWwH2HsrJFsKrGAuRMkhWvCZvGY+YNCFYuBIyUXvimaMH699rlK9r1GiKj; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D
2024-01-15 23:16:26 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7a4ea3a5acb9015b&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJqaLorPO9J5ynzWe-sJIwM6k1bFR2VzK0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: H5wNMf6PkahctnEo58-IW77vnseWCZynwxcNR6xrpMDGcTkgC3YUBw==
2024-01-15 23:16:26 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.5	49954	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1696	OUT	GET /pagead/viewthroughconversion/1060768846/?random=1705360583869&cv=11&fst=1705360583869&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUlxavrPxzZerrARIrWRgDeu4YBt9qW3-kyUhBpjjS3ynKiz3ZtbvSE73LuR; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:26 UTC	241	IN	Data Raw: 61 65 61 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 Data Ascii: aea(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;br
2024-01-15 23:16:26 UTC	1252	IN	Data Raw: 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b Data Ascii: eak a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break
2024-01-15 23:16:26 UTC	1252	IN	Data Raw: 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 4e 6b 39 46 64 6b 4e 4c 59 56 6f 7a 64 30 31 52 65 6e 42 71 62 79 31 52 54 54 6f 78 4e 7a 41 31 4d 7a 59 77 4e 54 67 7a 4f 44 59 35 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 Data Ascii: ined"==typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'Nk9FdkNLYVozd01RenBqby1RTToxNzA1MzYwNTgzODY5',['https://ww
2024-01-15 23:16:26 UTC	56	IN	Data Raw: 64 6f 6d 5c 78 33 64 33 37 33 30 34 38 37 38 34 33 5c 78 32 36 72 6d 74 5f 74 6c 64 5c 78 33 64 30 5c 78 32 36 69 70 72 5c 78 33 64 79 27 5d 29 3b 7d 29 28 29 3b 0d 0a Data Ascii: dom\x3d3730487843\x26rmt_tld\x3d0\x26ipr\x3dy']);})();
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.5	49957	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2375	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4786 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBsGANilsoqC4EIXe X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583
2024-01-15 23:16:26 UTC	4786	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 73 47 41 4e 69 6c 73 6f 71 43 34 45 49 58 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 73 47 41 4e 69 6c 73 6f 71 43 34 45 49 58 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 73 47 41 4e 69 6c 73 6f 71 43 34 45 49 58 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryBsGANilsoqC4EIXeContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryBsGANilsoqC4EIXeContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryBsGANilsoqC4EIXeContent-Disposition
2024-01-15 23:16:26 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4b35a3a532d300b2&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp7ZbkmaXJup-Hs2VPkN-Dt-2ShtpMa2tF x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ZKmYlduLGyxmG2Bq0uAcF9TIbK3q1XAAH-JFCUtoaZjZqairoX247w==
2024-01-15 23:16:26 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.5	49959	108.138.85.68	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1510	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA
2024-01-15 23:16:26 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3542174e2d71e2c3dffc0069aa7cbb34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: 64Rl8z32eyA4hIiJOZoAbkIjTaSyXhMLYDwF0zfQPmwbDPUl6Xfuuw==
2024-01-15 23:16:26 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.5	49958	3.162.103.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	388	OUT	OPTIONS /report HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Origin: https://www.booking.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	557	IN	HTTP/1.1 204 No Content Content-Type: text/html Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT allow: POST, OPTIONS access-control-allow-headers: content-type access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e4938fc434947f57a79af6b9b403df6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: 2iFDQRvyfmTILojjZwNDYOVnPFtYuYWnQ89N2gigbd8z9h1JMZCv4Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.5	49964	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:26 GMT X-Cache: Error from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: iwYCNb1nfXtwEbrzEuwkRrFLcy7ksJjzbXQ6tdRZljd9OxvV662ixg==
2024-01-15 23:16:26 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.5	49963	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2059	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ
2024-01-15 23:16:26 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3e43a3a58ee1059a&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsugZCEdE2meNhQgHuVaTLREPWmatjf3pV4 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: KELucKzk7piNzxpm2uy1sB34YxkIa3vxVMHDn_OuqYVIWfPin8BcXg==
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.5	49962	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1256	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360583943&cv=11&fst=1705360583943&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUmb0TEgpRDfsZQIAXRbUmT1eApBfU5VPCEXlBkIGU1ckv-_9H6-9vJ6EzD4; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:26 UTC	241	IN	Data Raw: 39 31 33 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 Data Ascii: 913(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;br
2024-01-15 23:16:26 UTC	1252	IN	Data Raw: 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b Data Ascii: eak a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break
2024-01-15 23:16:26 UTC	837	IN	Data Raw: 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 4f 45 64 53 65 55 4e 4b 4d 30 56 78 4d 57 64 52 4e 30 35 68 62 54 42 42 54 54 6f 78 4e 7a 41 31 4d 7a 59 77 4e 54 67 7a 4f 54 51 7a 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 Data Ascii: ined"==typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'OEdSeUNKM0VxMWdRN05hbTBBTToxNzA1MzYwNTgzOTQz',['https://ww
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.5	49965	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2655 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	2655	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 74 52 4b 69 45 75 51 38 41 41 41 41 3a 48 6e 70 72 41 65 41 4d 43 73 49 32 69 43 57 4b 2f 6a 4f 6f 74 32 75 4d 61 34 62 33 38 6f 72 49 4e 53 52 30 38 77 7a 4f 37 70 2b 70 64 57 6c 65 57 68 39 35 4c 39 77 56 79 44 4c 50 73 36 5a 56 73 73 6a 6b 57 56 51 6c 74 4e 6c 53 41 4e 34 46 7a 6a 71 50 61 43 62 5a 52 46 72 33 68 75 41 68 4e 4b 65 69 49 33 38 30 74 31 6b 70 69 31 58 36 36 6c 54 4f 35 50 54 38 76 43 69 4b 36 6b 52 6c 78 56 39 6c 73 2b 72 46 64 4b 57 75 59 35 76 4d 64 66 38 4d 79 78 79 41 78 48 78 76 77 56 30 47 76 42 61 50 46 4b 79 41 75 65 78 78 5a 46 65 7a 39 62 31 48 38 36 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86
2024-01-15 23:16:26 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1300 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:26 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcca-7bec49ab62b20ee87a7dd74c X-Cache: Miss from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: xW8CYN0H-kMeUuFQOCGumtf3elq3_11RJRXt6syAm4URefKFaulh9w==
2024-01-15 23:16:26 UTC	1300	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 44 65 69 46 38 73 38 41 41 41 41 3a 73 6d 7a 68 46 59 37 64 51 47 47 75 62 55 41 41 6f 6b 43 2b 73 43 6c 57 6c 48 42 34 39 50 4c 57 51 75 43 54 34 50 69 5a 79 65 51 6b 72 4e 77 50 63 6b 34 56 56 4e 54 73 6e 7a 54 45 41 52 5a 36 4e 5a 39 6e 70 42 52 38 78 72 4a 59 68 39 39 62 2f 4a 79 30 6b 49 43 54 50 4b 77 49 2b 37 32 58 54 6a 72 53 6b 4b 56 46 72 63 2b 44 6e 72 62 78 42 58 4e 4c 75 6d 4b 49 2b 36 5a 6a 4e 30 49 75 68 65 55 53 59 4c 6f 6e 54 34 76 65 7a 71 4c 52 6e 37 49 41 48 4a 44 37 53 51 36 6d 31 67 6c 66 36 35 67 2f 36 4c 35 54 58 71 61 42 51 67 63 35 6c 37 57 34 69 77 51 79 79 6f 4d 6a 36 70 2b Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.5	49961	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1392	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	2522	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"2144838804951865473"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"380439946797277586","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"2144838804951865473","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"2144838804951865473","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"2144838804951865473","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"2144838804951865473","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUluRRz_y0axlEkWKbtGlwiUvkdEq_KsL2PHlBJZ0PT3LxkCV7jnqLRABIGc; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.5	49969	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2375	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4603 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryccRL4CBFzACTJNxd X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583
2024-01-15 23:16:26 UTC	4603	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 63 63 52 4c 34 43 42 46 7a 41 43 54 4a 4e 78 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 63 63 52 4c 34 43 42 46 7a 41 43 54 4a 4e 78 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 63 63 52 4c 34 43 42 46 7a 41 43 54 4a 4e 78 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryccRL4CBFzACTJNxdContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryccRL4CBFzACTJNxdContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryccRL4CBFzACTJNxdContent-Disposition
2024-01-15 23:16:26 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b0a9a3a5d5bf076a&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpHBVB3hrj9xwcr6T0JGYnMLafYrSmDEpo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: xGIDSHKCNfdpqyu9RtSImlcq0TQ0OBZkqMmW-AKqil0IBbb8TYhfwQ==
2024-01-15 23:16:26 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.5	49966	216.239.36.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2465	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360581642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&_fplc=0&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=1523317164.1705360584&sst.gcd=11l1l1l1l5&sst.tft=1705360581642&_s=1&sid=1705360585&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=19904&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBI9EWd%2FKX1FgSFzfvOkDh0pDzLXxgZmKKMqR7KWwaCperLYAX3pziKYv5YusxMTaEuxQBjhkyfADzPutztf3Dg%2FrCZuOWvzZuqADhmspcKjFqj2C9M2W%2F7Khui1rAX6vmRqV2pyVJcZVR6pHyl%2Fm5gD0FOUQNgcMLY%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0
2024-01-15 23:16:26 UTC	774	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly set-cookie: FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; Max-Age=72000; Domain=booking.com; Path=/; Secure cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: 4acc75b3c6743055a95ec3ebf5767342 Date: Mon, 15 Jan 2024 23:16:26 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:26 GMT Connection: close
2024-01-15 23:16:26 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.5	49976	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1256	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360584011&cv=11&fst=1705360584011&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUkx2nJiyAvSzpFb2DLFkXGVwbI-IrQbStvIDe2KH9tw--C5ncbMesybcF2k; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:26 UTC	241	IN	Data Raw: 39 31 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 Data Ascii: 914(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;br
2024-01-15 23:16:26 UTC	1252	IN	Data Raw: 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b Data Ascii: eak a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break
2024-01-15 23:16:26 UTC	838	IN	Data Raw: 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 54 45 70 59 63 55 4e 4c 52 45 56 78 4d 57 64 52 4e 30 35 68 62 54 42 42 54 54 6f 78 4e 7a 41 31 4d 7a 59 77 4e 54 67 30 4d 44 45 78 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 Data Ascii: ined"==typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'TEpYcUNLREVxMWdRN05hbTBBTToxNzA1MzYwNTg0MDEx',['https://ww
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.5	49974	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2375	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4786 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIjCLhggz6y8QpbCB X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583
2024-01-15 23:16:26 UTC	4786	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 6a 43 4c 68 67 67 7a 36 79 38 51 70 62 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 6a 43 4c 68 67 67 7a 36 79 38 51 70 62 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 6a 43 4c 68 67 67 7a 36 79 38 51 70 62 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryIjCLhggz6y8QpbCBContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryIjCLhggz6y8QpbCBContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryIjCLhggz6y8QpbCBContent-Disposition
2024-01-15 23:16:26 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0b98a3a5bd28049a&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpgpbmzpBYNkOF5mDBcZShUzGRQRPw3rwM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: KuJJgIVKaGb-tCNBwgMbjkRr0XDY9fmhGgtnAS7EZd9pmmdA_0iKOg==
2024-01-15 23:16:26 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.5	49975	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2375	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4603 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUzZDlAlwcttlwM25 X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0TVJcFh9a5j%2FU7ERin1v0BiaeGLp%2FEthq86Vkd2G1KJ50EniYVJVT4J4Y5h2XbQ%2FsrGnP6Wj2%2BBV7K7avmY%2BxPyGDR1slSpXfQVdOOXEwh17I%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583
2024-01-15 23:16:26 UTC	4603	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 7a 5a 44 6c 41 6c 77 63 74 74 6c 77 4d 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 7a 5a 44 6c 41 6c 77 63 74 74 6c 77 4d 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 55 7a 5a 44 6c 41 6c 77 63 74 74 6c 77 4d 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryUzZDlAlwcttlwM25Content-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryUzZDlAlwcttlwM25Content-Disposition: form-data; name="lno"0------WebKitFormBoundaryUzZDlAlwcttlwM25Content-Disposition
2024-01-15 23:16:26 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:26 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f462a3a583b206a5&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpdEhjcZat-2ZECGwA44VLgSd9cuo9Zzzi x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: YTAGr9oNwuQloG1oLc0uoq3pgkbRRPfIIRpKohSjX72WwQSEJCduUA==
2024-01-15 23:16:26 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.5	49972	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1349	OUT	GET /activity;dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	1574	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUmOV8bY062z1ayQy2GC8CCHCfrgJGKqj3YUVyOCeCDKcs90v9sgpWiooVsRRTc; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.5	49973	142.251.16.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:26 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:26 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Cross-Origin-Resource-Policy: same-site Content-Security-Policy: script-src 'report-sample' 'nonce-cINnlM_7r6iwLLa5g9NCXA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:26 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.5	49970	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1256	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360584036&cv=11&fst=1705360584036&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:26 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUmCoMru3V8t7VQuMNDZi_SJGx4Qk5uY_WQImO076OGp4zvCkyrj88DOX-JV; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:26 UTC	241	IN	Data Raw: 39 31 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 Data Ascii: 914(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;br
2024-01-15 23:16:26 UTC	1252	IN	Data Raw: 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b Data Ascii: eak a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break
2024-01-15 23:16:26 UTC	838	IN	Data Raw: 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 51 6d 4e 58 4f 55 4e 50 59 56 64 7a 52 6d 64 52 61 7a 52 48 61 44 42 52 54 54 6f 78 4e 7a 41 31 4d 7a 59 77 4e 54 67 30 4d 44 4d 32 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 Data Ascii: ined"==typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'QmNXOUNPYVdzRmdRazRHaDBRTToxNzA1MzYwNTg0MDM2',['https://ww
2024-01-15 23:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.5	49977	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1135	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:27 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:26 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-VVHwJtxo2zdFTvNLQUISnA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:27 UTC	361	IN	Data Raw: 32 61 36 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2a60<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 46 46 2c 20 55 2b 32 30 32 30 2c 20 55 2b 32 30 41 30 2d 32 30 41 42 2c 20 55 2b 32 30 41 44 2d 32 30 43 46 2c 20 Data Ascii: boto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF,
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 Data Ascii: font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-sty
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 37 34 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a Data Ascii: to/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d Data Ascii: * vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 74 78 6f 32 7a 64 46 54 76 4e 4c 51 55 49 53 6e 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 56 56 48 77 4a Data Ascii: txo2zdFTvNLQUISnA" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js" nonce="VVHwJ
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 61 6e 59 7a 66 4a 75 6b 37 43 49 38 78 6a 32 65 48 69 32 6e 42 6f 37 2d 67 52 7a 61 72 75 77 33 74 4f 49 4a 36 35 4f 69 42 46 63 45 44 54 6d 48 62 73 74 4b 6e 45 79 2d 6f 42 68 31 53 69 66 4b 38 30 30 52 65 59 62 79 4c 52 57 64 69 49 67 62 4e 50 4d 5f 66 33 30 70 54 71 66 42 51 54 6e 32 62 4b 4f 59 30 31 56 4e 42 62 6e 6c 63 64 5a 31 69 6e 39 56 59 41 4b 34 68 42 42 73 64 42 6b 72 30 47 31 5a 6c 57 43 39 31 71 47 77 71 52 4f 53 48 68 79 68 33 35 68 6b 63 34 2d 33 76 64 66 4c 4a 39 33 55 5a 6d 65 4f 49 30 65 41 72 46 72 67 71 54 33 72 45 76 31 46 70 45 53 65 47 2d 34 44 43 4e 31 77 6e 32 6e 6a 4f 6c 58 59 2d 41 43 47 32 47 63 50 6b 65 6e 64 38 4f 69 49 37 75 67 71 34 59 2d 6a 6e 4f 34 4b 53 50 41 4e 66 38 67 65 36 77 56 7a 67 6d 69 51 70 67 4f 33 47 69 79 Data Ascii: anYzfJuk7CI8xj2eHi2nBo7-gRzaruw3tOIJ65OiBFcEDTmHbstKnEy-oBh1SifK800ReYbyLRWdiIgbNPM_f30pTqfBQTn2bKOY01VNBbnlcdZ1in9VYAK4hBBsdBkr0G1ZlWC91qGwqROSHhyh35hkc4-3vdfLJ93UZmeOI0eArFrgqT3rEv1FpESeG-4DCN1wn2njOlXY-ACG2GcPkend8OiI7ugq4Y-jnO4KSPANf8ge6wVzgmiQpgO3Giy
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 59 31 6c 43 59 58 63 33 51 31 56 79 55 46 56 51 5a 47 4a 68 55 48 46 69 4e 44 46 5a 5a 47 45 32 63 30 52 73 63 6b 74 53 4e 47 64 4c 64 32 68 68 65 54 52 59 62 6d 56 4a 4d 47 4a 56 51 6c 56 52 64 47 30 72 4e 58 4e 4d 53 6b 39 6d 56 58 6c 6f 4c 7a 4a 73 57 47 6c 7a 56 6c 42 50 62 56 70 35 54 57 46 50 62 6b 73 72 61 32 74 6a 54 56 46 54 65 43 39 4a 62 31 42 74 4e 48 68 4a 54 55 74 77 65 69 39 61 62 44 4a 42 53 44 56 74 64 43 74 6c 4b 79 39 46 51 6d 31 30 52 45 6b 79 57 48 49 35 54 30 55 72 Data Ascii: vbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz\x22,\x22\x22,\x22Y1lCYXc3Q1VyUFVQZGJhUHFiNDFZZGE2c0RscktSNGdLd2hheTRYbmVJMGJVQlVRdG0rNXNMSk9mVXloLzJsWGlzVlBPbVp5TWFPbksra2tjTVFTeC9Jb1BtNHhJTUtwei9abDJBSDVtdCtlKy9FQm10REkyWHI5T0Ur
2024-01-15 23:16:27 UTC	479	IN	Data Raw: 33 68 69 5a 6c 46 44 63 55 4a 6b 53 54 64 43 5a 53 74 4d 51 7a 6c 42 63 43 74 7a 65 56 42 76 53 46 46 44 4c 30 6b 33 5a 55 39 58 59 33 46 4b 55 6d 74 56 55 55 77 72 54 69 39 49 57 57 5a 43 4c 7a 41 35 56 45 67 72 4d 45 4a 70 4d 6e 70 4c 4e 55 6f 79 61 56 67 33 4d 7a 4a 75 5a 30 46 32 5a 48 46 6e 65 6e 4e 4a 61 47 64 57 53 48 4e 50 57 6c 42 70 62 47 74 79 59 6b 51 32 59 6a 4e 6f 4e 57 70 5a 5a 6b 38 76 62 6d 46 5a 4c 32 56 70 4e 6b 5a 50 62 48 4a 59 51 6d 59 7a 55 55 4a 6f 4d 7a 46 59 51 7a 68 73 56 55 74 61 57 57 64 58 4e 6d 6c 58 53 58 42 73 56 53 39 78 4f 54 59 34 4d 30 67 7a 62 46 46 30 51 33 64 53 54 54 6b 77 4f 45 31 30 61 7a 46 5a 4d 54 59 32 61 33 4a 4f 61 45 49 79 64 6c 4d 78 4e 30 39 35 65 54 5a 79 4c 7a 4e 33 5a 7a 42 43 56 57 4e 34 52 45 30 72 Data Ascii: 3hiZlFDcUJkSTdCZStMQzlBcCtzeVBvSFFDL0k3ZU9XY3FKUmtVUUwrTi9IWWZCLzA5VEgrMEJpMnpLNUoyaVg3MzJuZ0F2ZHFnenNJaGdWSHNPWlBpbGtyYkQ2YjNoNWpZZk8vbmFZL2VpNkZPbHJYQmYzUUJoMzFYQzhsVUtaWWdXNmlXSXBsVS9xOTY4M0gzbFF0Q3dSTTkwOE10azFZMTY2a3JOaEIydlMxN095eTZyLzN3ZzBCVWN4RE0r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.5	49980	3.162.103.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	330	OUT	POST /report HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 431 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:26 UTC	431	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 30 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 31 37 36 2c 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 32 34 39 2e 33 39 2e 39 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 Data Ascii: [{"age":101,"body":{"elapsed_time":2176,"method":"POST","phase":"application","protocol":"http/1.1","referrer":"https://www.booking.com/","sampling_fraction":1.0,"server_ip":"13.249.39.92","status_code":0,"type":"abandoned"},"type":"network-error","url":"
2024-01-15 23:16:27 UTC	389	IN	HTTP/1.1 204 No Content Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea42f57e1e0a065bc1c1c637f97d3be4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: viLSN5sB-z7Y3JJRcmL6ClVq6lOo7U70ptMxlRhQE0RpfOBxSSLyvQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.5	49981	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	1256	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360584157&cv=11&fst=1705360584157&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:27 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:26 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUlpXQ_b9clDMUAdz-uaC-2czPaszyQQmQK2CGeBZFh-sQRuiDxw9gGLp3qf; expires=Wed, 14-Jan-2026 23:16:26 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:27 UTC	241	IN	Data Raw: 39 31 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 Data Ascii: 914(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;br
2024-01-15 23:16:27 UTC	1252	IN	Data Raw: 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b Data Ascii: eak a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break
2024-01-15 23:16:27 UTC	838	IN	Data Raw: 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 62 58 70 74 63 45 4e 4e 59 6b 46 78 4d 57 64 52 61 7a 52 48 61 44 42 52 54 54 6f 78 4e 7a 41 31 4d 7a 59 77 4e 54 67 30 4d 54 55 33 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 Data Ascii: ined"==typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'bXptcENNYkFxMWdRazRHaDBRTToxNzA1MzYwNTg0MTU3',['https://ww
2024-01-15 23:16:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.5	49983	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2379	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4784 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryMxePSW7avgoBe3RW X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPef4Ce%2Fm%2BKwu%2FRG7Dfj5koVRWpDtwwufFz0A3S0Xz6yz0CDpjVuc8l4QF%2Fckb%2B68iqol1jxRUMoWVRG0vrEJnUIXNKmGt%2ByGrPwnH7cVxAK1hLCYg%2FewysHLgvARwXmfGE8QuLsWbbeJKgoszcTfmNIC3ggUkorUEoQ%3D
2024-01-15 23:16:26 UTC	4784	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4d 78 65 50 53 57 37 61 76 67 6f 42 65 33 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4d 78 65 50 53 57 37 61 76 67 6f 42 65 33 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4d 78 65 50 53 57 37 61 76 67 6f 42 65 33 52 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryMxePSW7avgoBe3RWContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryMxePSW7avgoBe3RWContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryMxePSW7avgoBe3RWContent-Disposition
2024-01-15 23:16:27 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dea9a3a5f98101ee&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpeewBuJPiOnw8cVROHp7ZhpZMpmEQyY0t x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: BlT2kptCWSghdlBU4GELHJjQMUZP5Kbd8OrHDSBNe5Qq3QXzFU1t5w==
2024-01-15 23:16:27 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.5	49984	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2373	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4784 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZyAfKWKx8NE5DWDN X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D
2024-01-15 23:16:26 UTC	4784	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 79 41 66 4b 57 4b 78 38 4e 45 35 44 57 44 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 79 41 66 4b 57 4b 78 38 4e 45 35 44 57 44 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 79 41 66 4b 57 4b 78 38 4e 45 35 44 57 44 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryZyAfKWKx8NE5DWDNContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryZyAfKWKx8NE5DWDNContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryZyAfKWKx8NE5DWDNContent-Disposition
2024-01-15 23:16:27 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=48b4a3a5436e0147&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpegvDI8bgmkXjU_dgZgqQvhHp55A-W0xm x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: U9Ro-dBrV6xXikl-_2eAWS7Zyz2WaG2zATZwuzf2d1QPP-XH5jTivw==
2024-01-15 23:16:27 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.5	49986	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	2373	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4784 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvQ0rUgT0YQlGDmtV X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAd3iigVAvAAAA:BjjeWkKTxYnRy/e22Ds8f/iwZWiWpuG3zupO1wtRZkqDStclxOSOZ3I21U6aflvjcEDaBKF9IF56aAkCjToEihAxKsIK4poe9V7V0/BK03kBID4XiEhO0MD7uxqhVkfY2FE3CdnoujB1CE1olW359+CD3W/SPCGhCOfaUu1I5ZJvvyuihRSXDJeA0p52kyjW23RVrw6pDoj2IjMEo0FHrDj5CrM12M+YIslZhiSCzvINTCB3Pn7IuATUL902JwMJ++COgVlj; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D
2024-01-15 23:16:26 UTC	4784	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 76 51 30 72 55 67 54 30 59 51 6c 47 44 6d 74 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 76 51 30 72 55 67 54 30 59 51 6c 47 44 6d 74 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 76 51 30 72 55 67 54 30 59 51 6c 47 44 6d 74 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryvQ0rUgT0YQlGDmtVContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryvQ0rUgT0YQlGDmtVContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryvQ0rUgT0YQlGDmtVContent-Disposition
2024-01-15 23:16:27 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1c4ea3a5c78d0492&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpTpW7DuqOMes286U24n5V2P-dQYC0RFPC x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: mV-CxIoYSxNfivLNsf6pSW1U9jALzi28RJ7vEFdIb_1SakWfGpAChA==
2024-01-15 23:16:27 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.5	49989	146.75.28.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:26 UTC	534	OUT	GET /ct/lib/main.43c0095c.js HTTP/1.1 Host: s.pinimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	481	IN	HTTP/1.1 200 OK Connection: close Content-Length: 22258 ETag: "5e494b9f81f274670ef4976a71beedcb" x-amz-server-side-encryption: AES256 Content-Encoding: gzip Content-Type: application/javascript X-CDN: fastly alt-svc: h3=":443";ma=600 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Access-Control-Expose-Headers: X-CDN Vary: Accept-Encoding, Origin Cache-Control: max-age=1209600 date: Mon, 15 Jan 2024 23:16:27 GMT
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: 1f 8b 08 08 21 dd 96 65 00 03 6d 61 69 6e 2e 34 33 63 30 30 39 35 63 2e 6a 73 00 c4 5c 0f 73 db b6 92 ff 2a 32 67 aa 10 21 a5 90 94 2c 3b 14 11 8d d3 e7 ce e4 da 26 9d 24 bd b9 8e c7 e3 a1 25 c8 62 2b 83 3e 12 b4 eb 67 a9 9f fd 76 01 82 04 25 d2 76 dc de bc 69 63 93 20 b8 f8 61 b1 ff b0 0b fa 60 59 f0 b9 48 52 6e 27 e4 e1 36 ce 7a 8c 3e 6c a7 ba b1 97 d9 42 35 f3 69 c6 44 91 71 9b 9d 89 f3 cd c6 e6 14 2f e8 43 12 0a 77 1d 1e f8 2e fb f3 26 cd 44 1e 3e 6c b7 6e 02 8f 86 f3 78 bd b6 f9 b0 6c 77 b9 5b 5f 67 04 6e d6 f4 c0 73 39 21 ba 75 9b 0d af 69 e2 66 c3 39 65 f0 73 41 2b 64 02 5e 06 74 d9 30 c5 4b b2 d9 7c ba fc 9d cd c5 70 c1 96 09 67 bf 64 e9 0d cb c4 bd ec f6 c0 78 71 cd b2 f8 72 cd 42 20 7f c5 44 98 6c c9 16 e8 65 06 3d f2 60 15 5c bd bd b0 0e a8 b8 Data Ascii: !emain.43c0095c.js\s*2g!,;&$%b+>gv%vic a`YHRn'6z>lB5iDq/Cw.&D>lnxlw[_gns9!uif9esA+d^t0K\|pgdxqrB Dle=`\
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: a6 5a 0b be f1 1c c8 ff 77 c2 ee 20 c6 dd 6f 84 11 c1 a5 77 79 9e 1a 4c ed 17 ca 38 d7 50 b6 5a 66 67 96 e5 88 3a ba 40 ec 68 d3 13 4d c7 33 d6 ed c0 9f 4e 49 7e 97 88 39 86 24 0f f3 38 67 56 9c cf 93 c4 0a e5 f5 1a 64 91 fb e5 0d 04 ad 71 76 6f 85 3a 5c 9d ca 56 a9 cf a1 be 1c 94 d7 3d e5 4b 74 df df ed 1a 8f ea 3a cf 03 fd d6 3c 1f 04 35 05 7f 02 db 89 9a 9e ba 2d c9 04 af cb 41 57 ec cf 1a c7 bb 77 ef 7c d5 7c 09 3f 26 e3 ea c9 1f c6 a8 65 a0 1c 4a 0f d0 82 8a 53 1b f8 c6 51 7a 7e 4a ef 58 f6 3d 90 b2 09 58 39 d8 b3 d4 f2 52 ed d2 24 fb c0 64 01 03 81 22 ec 5b 2a df c9 37 1b a5 9a 9c bc c3 00 47 ab 4d e9 22 2c d9 3f a9 fb 27 9b 4d 62 76 9c 19 d7 61 42 22 ea ed bc 0a d3 85 b6 88 da 5c 5d d5 8f 71 5d 05 15 e0 9b e4 a2 d4 4b 2b ca a5 95 6c 43 e8 29 95 b1 Data Ascii: Zw owyL8PZfg:@hM3NI~9$8gVdqvo:\V=Kt:<5-AWw\|\|?&eJSQz~JX=X9R$d"[*7GM",?'MbvaB"\]q]K+lC)
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: c1 b6 fe 1c a4 4f bd 02 57 99 43 57 5b 14 87 35 65 10 36 ae 0d 1b ba 88 e8 b5 56 d0 96 c8 64 18 df dc ac ef 6d f5 a4 19 58 42 84 73 0b 1a 71 1b 2d a6 e4 ae 35 ac d9 79 b9 0c 90 6e dd 5b 07 c6 ac c4 ff 6e fb e3 50 79 02 ba 72 7f 1c 7e 59 a7 77 e5 ad 69 08 1c 4c 2a 01 1f 04 44 10 75 fa 5a 6e a1 6d 08 77 b6 f0 e6 87 8f 5f 7e 39 fd fe eb c5 cf 27 ff 73 f1 fe b7 af a7 5f e8 a1 d7 ee 3a 69 e5 39 44 6b 8e af b5 d5 2c 44 88 ec 5e aa d7 5e a6 dc af c0 09 23 47 f8 50 5d b6 fa 58 77 99 a6 2d 65 8e 71 b0 dd ba e3 40 c6 58 d0 c3 26 ad 1e 5f 0c f3 e2 52 e6 b2 fa 7d 15 8f e9 7b db 77 7d 62 6c ad b7 f3 b8 dc 32 a9 01 0e fc ed 16 22 c2 1f 87 7f fc 1c ff a9 ba 60 e2 02 58 76 93 a6 eb 2f c9 bf 19 3d 06 01 87 fb 55 eb f6 a7 3d 09 ea 8a ad ab 42 a2 fd 02 a0 4e cf 4b 23 a4 1a Data Ascii: OWCW[5e6VdmXBsq-5yn[nPyr~YwiL*DuZnmw_~9's_:i9Dk,D^^#GP]Xw-eq@X&_R}{w}bl2"`Xv/=U=BNK#
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: 5b 39 77 e7 f4 76 5b b5 3c 5e 3b 5c 94 45 cf ef ed df 41 1f ec 42 f2 49 d7 81 07 30 d1 c2 5d b8 71 b3 ae 58 be 7a df 38 32 f7 64 85 bc a5 fb 4e ad 4e 0d 8e 09 7b d8 49 21 24 2c 59 cb d5 4d 5f 56 74 d3 95 c1 c6 c8 46 75 2c 7f 7e 75 8c a1 f0 61 51 7c b7 40 80 92 e7 6d 77 e3 9e ff fa f2 e9 23 dd 4b cf 3c c8 13 5f fa 24 93 8b 07 95 c2 dd da 89 34 e2 65 d1 04 15 e7 22 ce 32 75 c4 d1 05 ad dc 4e 55 69 74 ec bd 9d d4 a7 43 2f 8d 53 92 e2 3b 30 c4 a0 7d 9d 07 6e 2c 65 42 94 dd 10 bd 22 e1 42 f9 b7 24 12 4e d7 c9 d0 af d9 3d 9e 17 c2 13 28 f3 39 cb 73 f0 e5 f7 29 5f 68 05 d5 87 44 eb fc f3 55 1d 2d c0 ea 3d 33 5e 78 65 29 7a ad a7 89 de 37 4f a0 bd 2a 7d b2 3c 61 90 76 9d 2d da 3d 0c b9 7b 32 50 51 49 1c 56 05 0a 9d 47 63 c1 ef f4 cc d0 c0 9c ed 69 ed 4b c0 ea c9 Data Ascii: [9wv[<^;\EABI0]qXz82dNN{I!$,YM_VtFu,~uaQ\|@mw#K<_$4e"2uNUitC/S;0}n,eB"B$N=(9s)_hDU-=3^xe)z7O*}<av-={2PQIVGciK
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: 5c 14 b6 57 e5 cd 88 0d 92 59 7d eb 20 ff 06 89 59 c0 c7 ea 3f fe 8d 95 88 95 e7 c4 d2 01 e6 fd 68 36 05 77 46 f0 04 38 2f f3 a0 99 93 9c 57 d5 e2 34 f2 d9 48 9e 48 ec fa 2a 59 1d 17 d3 d9 f7 36 32 ad df d9 e4 4c e8 cf 6b e4 f4 aa ec 6e e2 26 4e 0a 72 52 ff dd 83 a6 ec e1 41 cf 76 d9 db ff 5c bd fc 63 0f ed 7f 13 03 3f d1 e2 58 dd 6e d6 bb 49 f8 7f ec 5d 7b 53 db c8 b2 ff 2a 89 2b 4b 49 eb b1 d1 e8 2d 83 96 43 cc 23 0e 04 b8 3c 92 dd e5 38 94 62 0b 50 00 db eb 07 09 8b fd dd ef af 67 46 d6 c8 36 fb a8 ba e7 9c ba 55 e7 8f 84 d1 3c 7b 7a 7a fa 21 75 b7 97 bd 4e c5 29 64 0b fd 18 d7 e8 51 7a 75 e8 f1 10 96 69 6e 42 41 10 1c 6c 98 3b 80 c8 e0 9d a5 50 df 74 f5 c7 bc 79 82 8e 15 b9 37 56 6d 09 53 bf 2e 85 f0 a7 2f f8 b6 ac fe 4a 28 82 66 96 82 b3 c4 ab 7d 11 Data Ascii: \WY} Y?h6wF8/W4HHY62Lkn&NrRAv\c?XnI]{S+KI-C#<8bPgF6U<{zz!uN)dQzuinBAl;Pty7VmS./J(f}
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: b6 1a 17 d9 b4 65 f6 c6 28 85 53 ee 4f 1d db 44 b1 79 9f 3c 0c d2 ae 29 67 78 b3 5e 1f e3 b2 93 1f ad da 90 d4 b0 97 f0 a2 df 89 15 9e a0 49 e1 eb da 4d 25 dc 93 61 fa aa d7 ef d5 04 05 41 c0 cc 7d dc ea ff ec b5 80 fb 61 97 52 3c f5 c5 6d 52 5d 98 18 20 33 34 ca 4c 64 2a 86 ed 36 79 24 13 67 89 48 0d f3 d5 43 3a be ed 77 29 63 99 b1 98 65 d0 7c 56 a1 76 3d e1 b0 9b cb f3 f2 cb 05 8d 7b 5b 4c 4a a7 3c d5 a3 48 a7 95 81 d3 a6 97 99 cc 03 52 b8 bb 48 f5 e1 79 b6 31 ac 1f b6 ce ce e3 e7 bd 93 ab c3 e3 e6 f6 e1 d5 d9 f9 f1 e9 f6 fe 6e e3 19 ca 37 76 db e0 96 c5 26 c3 ac 51 b9 1e 5c 51 9a ab fb 33 40 9e dc a4 95 19 db d9 3d 6d 7d 84 e9 bc 7b d2 3a 58 ee 3f c8 7a 35 e0 28 7b 4c bb b5 74 90 dd 61 c0 59 f3 74 fb 64 f7 8a 56 dc 3d da 3d 3d 5b 3d 68 d4 19 26 83 b4 Data Ascii: e(SODy<)gx^IM%aA}aR<mR] 34Ld*6y$gHC:w)ce\|Vv={[LJ<HRHy1n7v&Q\Q3@=m}{:X?z5({LtaYtdV===[=h&
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: e0 20 0c c7 c6 41 3b dc c5 64 8e 63 83 1c 81 c5 b0 5d d2 bd 7c d7 d4 33 f7 2b 23 9f 42 be 0c 65 e9 7d 85 e9 9a 69 e6 95 8f 2d fa e6 6c 6c 0c 29 50 70 58 0a ce cb 4a 51 aa ba 01 7c 17 e3 34 22 cb c1 46 1d 39 6f 33 06 64 2e 77 5c ec 47 d6 1c 40 1e 72 22 4e ec 46 d6 1c c5 02 a7 82 22 65 cd 4e cc 1d 10 65 e4 70 1e c9 9a 0f b1 8d b3 21 42 50 1f 1c eb 17 31 51 95 e3 e2 e8 65 c5 49 cc 3d 97 bb 38 74 db 53 66 f8 70 b5 41 aa a7 7f ca 3f 35 7c a5 88 7c 69 e5 de d1 ab 05 59 6c 92 ab 98 2c 1e d0 8b 61 59 3c a2 f7 06 b2 b8 03 f5 41 15 3f b0 eb bc 78 41 a1 95 b2 78 c2 6e 63 6b e3 76 93 fb 1b d5 ea ad 99 5d de 42 f5 d5 bd 17 0d f7 47 a5 35 a3 97 ef 16 bd ac a9 41 ef f9 50 ae d9 6d 91 95 27 98 f6 36 37 b9 67 7e 16 2f f0 79 24 1e 1d f3 b3 78 b2 cc 2a 75 0d da d5 f9 30 ee Data Ascii: A;dc]\|3+#Be}i-ll)PpXJQ\|4"F9o3d.w\G@r"NF"eNep!BP1QeI=8tSfpA?5\|\|iYl,aY<A?xAxnckv]BG5APm'67g~/y$x*u0
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: 36 a9 a7 25 b2 8d fc 4d 8b e4 70 c9 22 79 bb 64 91 ec 2f 59 24 7b 4b 16 c9 9b 25 8b e4 fd 92 45 f2 71 d1 22 79 b7 68 91 d4 7f 8b a1 52 44 90 70 c4 b2 44 cd 2f 31 5d 71 0c 03 cf 94 35 bf c6 00 8d 43 ea 81 b5 c8 9a 4f 98 07 6c 88 a4 a4 5a fc e7 18 22 00 57 db e3 8e da c4 78 1c 83 67 82 1d 42 48 ca 9a 1e f9 73 82 2f 81 e2 5c d5 09 78 02 6b 05 36 6c 2b fa eb 26 52 6e 20 65 b9 4d 73 58 d8 4a 6f 0b 5b 69 bf b0 95 f6 0a 5b e9 4d 61 2b bd 2f 6c a5 8f 85 ad f4 ae b0 95 7e 23 5b 49 16 7f a1 6c c0 b2 f8 2b eb e6 c5 4f c2 84 90 18 a0 1c a1 53 b5 75 f6 94 97 7b 63 36 c8 cb d9 98 3d c0 96 79 d8 74 ec 8d 07 4a 14 d6 bb 7c 58 36 be 1e 4c 86 7a e1 bd ba d8 42 69 ab 84 61 f6 00 f3 cd 92 73 3c ab fc ec 97 0f 35 c7 6a b3 1b 55 a2 3c af bb b1 f1 85 08 7c 7a 83 1b 42 56 11 3d Data Ascii: 6%Mp"yd/Y${K%Eq"yhRDpD/1]q5COlZ"WxgBHs/\xk6l+&Rn eMsXJo[i[Ma+/l~#[Il+OSu{c6=ytJ\|X6LzBias<5jU<\|zBV=
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: e1 1d d6 29 3d d7 1f 6e e3 8a eb 74 e8 d3 5a a7 c2 68 94 e6 31 b6 d4 17 3a 67 b7 3e a4 89 1d 32 23 38 17 9f 7a c7 86 0d dd b0 5b ef 8f e3 6b 15 9c 71 31 cc 3e 65 e3 db ff 99 a4 c3 27 e1 91 87 ba e1 08 83 a1 72 37 85 27 e1 28 ee 68 0f 68 99 d0 b4 b6 2d 83 39 0f a9 ec 98 f5 47 97 7d 8b 2b a3 74 44 e0 e4 ee a3 e4 32 57 f2 27 65 6f e3 4a 37 1d 54 d8 ef b4 f1 d1 38 7e be 10 39 b8 5b 7b ad dd 9d 86 c5 72 af d1 2b e9 45 da e0 ec 64 7b 7f f7 ea f0 78 7b a7 61 b3 dd 8f e4 08 79 f6 ee f8 a4 b5 f7 4b de c5 61 e7 db fb 67 57 a7 bb cd 5d 72 54 6d b8 aa 9b a8 dd 7e 7b 86 72 c3 9b b1 e7 b3 83 d6 09 55 5e 35 8f 8f f6 5a fb 14 27 d9 a9 cc 4c b6 1f 3b be c7 1e e3 ca 49 ee c0 f6 ea 3c b9 91 4e f5 8d 57 15 b6 b7 d8 f2 29 19 f6 64 d4 21 1b c7 2f 7a c0 55 d8 13 fd 2e 2a 1d c2 Data Ascii: )=ntZh1:g>2#8z[kq1>e'r7'(hh-9G}+tD2W'eoJ7T8~9[{r+Ed{x{ayKagW]rTm~{rU^5Z'L;I<NW)d!/zU.*
2024-01-15 23:16:27 UTC	1378	IN	Data Raw: 23 a8 8e 0e 64 11 ee 59 a9 29 1c f8 fe 84 cf bd 5c 08 38 91 2f bf 45 73 b3 d5 b9 31 55 a0 19 ca cd 7e 83 8b cf a7 f2 84 48 ba a2 7e 04 a2 3a 19 19 19 b2 ba ff 9f 09 a7 dc 10 cd b6 cf ce cb 28 d5 a3 ea 8a 37 c2 79 83 c5 b8 87 5e e6 47 9e 9b 7b 13 a5 a2 f5 ca bd 08 27 f3 30 e1 97 ce 49 97 88 57 a3 ae bd 55 75 8d e2 49 5c 57 e1 17 a3 c2 3d 41 27 b0 52 e9 58 ac aa 75 7e 51 57 e7 47 b3 93 d5 0a b1 06 3f 87 87 45 c9 da ca c7 61 5d e5 7f 18 95 1b 8b 45 70 92 08 06 73 ad 98 f3 9b 2e e9 00 84 4b 82 0c 21 3f c4 83 25 b1 c8 72 bb c8 0b 11 1c e0 25 6d 83 00 d7 97 17 17 3e 6f b5 43 39 18 dc 37 94 60 50 37 94 df 56 0f 65 10 25 e2 22 20 f0 a5 1e e8 34 05 b3 41 79 68 84 21 77 ba 6d e0 c9 ee f9 a6 f1 42 83 e6 a7 9b 27 b7 4e 3b 7b 02 62 2d 86 08 32 ba 3c 44 4a ab 0e f1 74 Data Ascii: #dY)\8/Es1U~H~:(7y^G{'0IWUuI\W=A'RXu~QWG?Ea]Eps.K!?%r%m>oC97`P7Ve%" 4Ayh!wmB'N;{b-2<DJt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.5	49985	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	806	OUT	GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:27 UTC	1090	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUnE2C_KI4ee1ZVnf5w375y3YjNd3Nvw4PC_ZdMetXCqJgw9McDzSi-VrpqD; expires=Wed, 14-Jan-2026 23:16:27 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.5	49987	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	1290	OUT	GET /pagead/1p-user-list/988382855/?random=1705360583484&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_xliVs_MDyw-B6DZ1oXHSkYdYBWCxlg&random=2826677896&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:27 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.5	49992	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	2951	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _ga=GA1.2.810723182.1705360577; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VrPu5mELHGB7FQnXtuBzt9%2Fa4wZr6bXu0mqPvPSrYmDLT6ly4V6PGJBmeiSwzkq3b8VU9sljw811Mvb1vAa1HlQmjL1wS4PqOWxajiYIlGKrJqpgn5adK63W84sGd2bP5JjGsrLxuRvBxd9J%2BM6j%2FgjkhWgMyjOVw%3D; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86E4lsRasrb6ehFk/WxxWJbx6fHaCyOgGrR+Rhwa4NYFrsFm8k+wPCuZNRasJjscYTwXW1b58qLiVUnDe9Jn
2024-01-15 23:16:27 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 6e 6f 5f 61 64 5f 72 65 74 75 72 6e 65 64 5f 66 72 6f 6d 5f 67 70 74 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"no_ad_returned_from_gpt","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-01-15 23:16:27 UTC	1101	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzk%2FvPO5nhU0XjJ5v%2FbwxVjqjvL8mqFXol93fc64YsFZWM88CQin%2B6BL910ze9NGf7UokKRKxWyd%2BL89nmvJCk9vStPIXXjn%2BU3V7C6opuW%2Bj%2FavxgrvcNVs41F3dl3N2pb2GgpIj7WKLLCNQbmrJQheHbneYfmWEdA%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:27 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1c4ea3a5269a0098&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZrdZD2IRE3BMV2erEvvjiL2cZItr85XEg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: b7qM0O1sXUdzMNBpxfzLpVeJvB9D87S1nNrU0fM36YXOCTwpyKaxDA==
2024-01-15 23:16:27 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 63 68 69 6c Data Ascii: {"data":{"trackAdStatus":{"name":"JSON","directivesByName":{},"allDirectivesByName":{},"allAppliedDirectivesByName":{},"coercing":{},"childrenWithTypeReferences":{"empty":false,"children":{"directives":[],"appliedDirectives":[]},"childrenAsList":[]},"chil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.5	49993	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	3056	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86E4lsRasrb6ehFk/WxxWJbx6fHaCyOgGrR+Rhwa4NYFrsFm8k+wPCuZNRasJjscYTwXW1b58qLiVUnDe9Jn; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBI9EWd%2FKX1FgSFzfvOkDh0pDzLXxgZmKKMqR7KWwaCperLYAX3pziKYv5YusxMTaEuxQBjhkyfADzPutztf3Dg%2FrCZuOWvzZuqADhmspcKjFqj2C9M2W%2F7Khui1rAX6vmRqV2pyVJcZVR6pHyl%2Fm5gD0FOUQNgcMLY%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0
2024-01-15 23:16:27 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-01-15 23:16:27 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:27 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6cdaa3a597bd01b6&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGe__Q--DL9xnnRcThRW0I7_6QLj2nQVYvQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: iW2n21y-zTrH0xa1etmue8TwM2ZtX-a6WOu0bJNkS5Ji6_-GaJwtLQ==
2024-01-15 23:16:27 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c Data Ascii: {"data":{"trackAdStatus":{"directivesByName":{},"childrenWithTypeReferences":{"empty":false,"childrenAsList":[],"children":{"directives":[],"appliedDirectives":[]}},"children":[],"coercing":{},"allAppliedDirectivesByName":{},"description":"A JSON scalar",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.5	49994	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	3191	OUT	GET /js_errors?pid=d7cca39c07340212&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAtRKiEuQ8AAAA:HnprAeAMCsI2iCWK/jOot2uMa4b38orINSR08wzO7p+pdWleWh95L9wVyDLPs6ZVssjkWVQltNlSAN4FzjqPaCbZRFr3huAhNKeiI380t1kpi1X66lTO5PT8vCiK6kRlxV9ls+rFdKWuY5vMdf8MyxyAxHxvwV0GvBaPFKyAuexxZFez9b1H86E4lsRasrb6ehFk/WxxWJbx6fHaCyOgGrR+Rhwa4NYFrsFm8k+wPCuZNRasJjscYTwXW1b58qLiVUnDe9Jn; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D
2024-01-15 23:16:27 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0419a3a5352f00bb&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpcCpVT5ECbSHQz9liAEh0vx8z7dMhlhGi x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: YP54dy7ZwaGiRMZXdWolnThsDteO4zoU12F-TXmiOMDdYIX1Aw81-w==
2024-01-15 23:16:27 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.5	49982	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	827	OUT	GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=1523317164.1705360584&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-01-15 23:16:27 UTC	960	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE; expires=Wed, 14-Jan-2026 23:16:27 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.5	49997	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	3447	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 357 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU2OCwiZXhwIjoxNzA1NDQ2OTY4fQ.Iuw5fMmJyU84MmuDyXdeqEoEnaPgYY7pYxI0LtibrKAXCm9_W3UqMMLIrAcGo3eA5YW4UE3uuvvTab2EoWq4WQ x-booking-et-serialized-state: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: d7cca39c07340212 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:27 UTC	357	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 61 74 69 6f 6e 20 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 64 69 73 6d 69 73 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 Data Ascii: {"operationName":"DismissGeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"mutation DismissGeniusSignInSheet($input: DismissGeniusSignInBottomSheetInput!) {\n geniusGuestMutation {\n dismissSignInBottomSheet(inpu
2024-01-15 23:16:27 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 172 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:27 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=eda1a3a5a187002f&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGTmDzqFyXDkQydIHiAtSzsPqtxt5rLe50A x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 5g_FkE17tgvQ6ClCHfzAuzYtERcu2yO9fb4UO8kzY1fEOL0g-Z-XDw==
2024-01-15 23:16:27 UTC	172	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 22 3a 7b 22 64 69 73 6d 69 73 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 4d 75 74 61 74 69 6f 6e 4f 75 74 70 75 74 22 2c 22 65 72 72 6f 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 69 73 53 75 63 63 65 73 73 22 3a 74 72 75 65 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 73 22 7d 7d 7d Data Ascii: {"data":{"geniusGuestMutation":{"dismissSignInBottomSheet":{"__typename":"GeniusMutationOutput","errorMessage":null,"isSuccess":true},"__typename":"GeniusGuestMutations"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.5	49998	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	3350	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: E4ECm6iYDHF47sokHkhtzgj1zke-AizBgL7QExTMSNUK08Swh27kI71s678eWd1BE X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:27 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1e88a3a55f33010f&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLME7KvhjJtHhDbxNxurv9P_P58wAS3aHE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: DBQT0edrH3bMJK6R1SV_mbhqIdIyQEwKoZi2LyD7H_UGBCp1whgE0g==
2024-01-15 23:16:27 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.5	50001	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	452	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 28 Dec 2023 21:11:24 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: QHzE4R5zqVLLJdH8bNpdGgsGtOUGagdMk5xjY2qe11sbf2ucxGmH3Q== Age: 1562703
2024-01-15 23:16:27 UTC	16384	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-01-15 23:16:27 UTC	14236	IN	Data Raw: ad 6e e9 56 69 62 a0 5e 4f 1a 5b c0 e2 69 5e 3e 72 0a e5 47 ae 48 22 8b 77 25 5e e7 a5 e8 d7 49 6b a3 c0 16 46 e9 8c 0f bc ed fc ea b9 d2 75 5d 42 fe 59 2e 16 28 21 04 14 8c b6 7f 13 8e ff 00 8d 59 f0 c4 d6 d2 59 45 a8 4d 0b 0d f9 31 c6 07 11 af f8 d2 6a de 26 06 e6 68 2d 23 0b c8 52 db c7 7f 61 cd 34 cd 6c ba 1a e3 49 49 6d 96 49 dd 9d 93 18 2a 76 f1 55 75 0b 4b 0d 5a d1 6e 66 b5 86 69 6d 9c db b9 74 0c 46 3a 75 fc 0f e3 57 0d ec 83 4f 65 0e 17 09 d9 70 3a 7a 9a e3 74 2d 66 48 bc 4b ad e9 37 2e 4a 5d 44 2e a1 27 fb c1 46 7f 41 fa 56 75 13 56 97 62 93 5b 77 23 bf d0 b4 26 61 e6 e9 d0 8c f7 4c a1 fd 2b 12 7f 0b 68 d7 13 18 a1 7b 9b 62 7e eb 07 de a7 f3 ae a6 f8 c7 3c 0c 06 37 0e 45 72 e2 ed e2 9d d5 cf cb da b4 bb 21 a4 64 5f 7c 3f b8 00 b5 a5 fc 53 0f ee Data Ascii: nVib^O[i^>rGH"w%^IkFu]BY.(!YYEM1j&h-#Ra4lIImI*vUuKZnfimtF:uWOep:zt-fHK7.J]D.'FAVuVb[w#&aL+h{b~<7Er!d_\|?S
2024-01-15 23:16:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.5	50003	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:27 GMT X-Cache: Error from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: uH5Pn26_BnaaDsE4wQrHTYaFkjteyRwZf6JPEH167UYxmp5qfix5aQ==
2024-01-15 23:16:27 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.5	50000	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	401	OUT	GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Sun, 24 Dec 2023 15:54:43 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT ETag: "6419ae08-4ad" Expires: Tue, 23 Jan 2024 15:54:43 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 7M7cItFevFhg26BLff9yeQuWF4aT3bgV6MWPWAUgSA4YV214T3nmfQ== Age: 1927304
2024-01-15 23:16:27 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.5	50004	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:28 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d04da3a5c8ae0247&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstk7nm_MNgzcH_Ec6n585jR5Q97bPAVkLY x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 148f45d892bd2198be5295012ed59888.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CjJxFrw9nT6GTXNpYjwCMejxMZzxNiCpNJ9agIXDbp4twKzpuoyOag==
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.5	50002	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	4350	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=996245b2-90e2-4786-a13b-818ee45c913d&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=884839914 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:28 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c7fba3a52c860063&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjrpsSB7UNqrhpKSc6FqoO-hltjemW4p_Fg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 0rTUMbSsOkQon9TSYevOh1Q-1cGfXkm0eQB_6KDZi4lIcy-4nEaUKQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.5	50007	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	5249	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|2&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:28 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:27 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d8dca3a56af80764&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ4__0xo3SSvxgcpCia4TdxJ5HTlxXAJjM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: -6N0QyBT0xpVr1i6fpcBmwXjh6KLAzsP72T0r_Se_Tx2v3z6lkc0uA==
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.5	50009	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	1865	OUT	GET /pagead/viewthroughconversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=ybylZdS2LP25oPMPl9SGwAY&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nygbtVC6gzGCQmlO3hrw4g-KmzeWNhN8p48&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUnE2C_KI4ee1ZVnf5w375y3YjNd3Nvw4PC_ZdMetXCqJgw9McDzSi-VrpqD
2024-01-15 23:16:27 UTC	1793	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-conversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg&is_vtc=1&ocp_id=ybylZdS2LP25oPMPl9SGwAY&cid=CAQSKQAvHhf_6MyPeivjXG9NQFiUHvFpiH-bdHK0pXPJOVzHVDhkBUZ_CIUy&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nyjkNN3DKD3Ik-v9lvBOTd6pcmKXvc6N2K4&random=3129231315 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:27 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.5	50006	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	1024	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:28 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.5	50015	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	812	OUT	GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	611	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:27 GMT set-cookie: sc_at=v2\|H4sIAAAAAAAAAAXBgQ0AIQgDwIlI6CuK4wDWKRj+72bRXx7I+QiZzJCAUfLprY3IVezGVhtLzb31Bx/ZeAAyAAAA;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure content-type: text/html strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 672 x-envoy-upstream-service-time: 9 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	672	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 77 69 6e 2c 20 64 6f 63 2c 20 73 64 6b 5f 75 72 6c 29 7b 0a 20 20 20 20 20 20 69 66 28 77 69 6e 2e 73 6e 61 70 74 72 29 20 72 65 74 75 72 6e 3b 0a 20 20 20 20 20 20 76 61 72 20 74 72 3d 77 69 6e 2e 73 6e 61 70 74 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 20 20 20 20 74 72 2e 68 61 6e 64 6c 65 52 65 71 75 65 73 74 3f 20 74 72 2e 68 61 6e 64 6c 65 52 65 71 75 65 73 74 2e 61 70 70 6c 79 28 74 72 2c 20 61 72 67 75 6d 65 6e 74 73 29 3a 74 72 2e 71 75 65 75 65 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 74 72 2e 71 75 65 75 65 Data Ascii: <!DOCTYPE html><html><head> <script> (function(win, doc, sdk_url){ if(win.snaptr) return; var tr=win.snaptr=function(){ tr.handleRequest? tr.handleRequest.apply(tr, arguments):tr.queue.push(arguments); }; tr.queue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.5	50017	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2742 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	2742	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 44 65 69 46 38 73 38 41 41 41 41 3a 73 6d 7a 68 46 59 37 64 51 47 47 75 62 55 41 41 6f 6b 43 2b 73 43 6c 57 6c 48 42 34 39 50 4c 57 51 75 43 54 34 50 69 5a 79 65 51 6b 72 4e 77 50 63 6b 34 56 56 4e 54 73 6e 7a 54 45 41 52 5a 36 4e 5a 39 6e 70 42 52 38 78 72 4a 59 68 39 39 62 2f 4a 79 30 6b 49 43 54 50 4b 77 49 2b 37 32 58 54 6a 72 53 6b 4b 56 46 72 63 2b 44 6e 72 62 78 42 58 4e 4c 75 6d 4b 49 2b 36 5a 6a 4e 30 49 75 68 65 55 53 59 4c 6f 6e 54 34 76 65 7a 71 4c 52 6e 37 49 41 48 4a 44 37 53 51 36 6d 31 67 6c 66 36 35 67 2f 36 4c 35 54 58 71 61 42 51 67 63 35 6c 37 57 34 69 77 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iw
2024-01-15 23:16:28 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1389 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:27 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bccb-07bcfd8a109f3df832fdb84b X-Cache: Miss from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: MXTgg1-OCDCxhf3da5V0cWkj7Qn1S61tuJBOJ8O7ElncK2wklniGmg==
2024-01-15 23:16:28 UTC	1389	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 66 34 61 69 78 61 73 58 41 41 41 41 3a 54 7a 66 37 71 45 75 4a 4a 6e 6a 2f 6f 75 43 6b 4c 39 48 72 30 4c 5a 4a 41 79 55 6f 42 47 38 4e 4f 4d 54 47 71 75 6d 78 44 39 4f 41 4d 4a 41 4b 6a 74 53 47 5a 6a 59 31 37 63 7a 51 47 37 6a 79 45 68 5a 6f 46 38 71 33 67 33 34 61 68 38 38 71 79 31 6e 77 59 6d 2b 6e 77 57 59 31 73 44 6f 74 45 76 33 61 45 43 77 32 65 72 43 61 48 4e 5a 51 58 32 7a 6e 43 6c 76 6d 6b 39 78 39 5a 6c 6e 5a 64 37 4e 79 54 41 2b 6e 77 73 34 50 63 67 41 45 43 44 47 36 53 43 43 34 33 4c 50 39 79 36 31 4b 4f 4f 2b 44 74 37 73 73 61 56 4b 6e 69 77 53 61 77 31 44 42 62 76 66 77 6f 4c 61 72 73 54 35 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAf4aixasXAAAA:Tzf7qEuJJnj/ouCkL9Hr0LZJAyUoBG8NOMTGqumxD9OAMJAKjtSGZjY17czQG7jyEhZoF8q3g34ah88qy1nwYm+nwWY1sDotEv3aECw2erCaHNZQX2znClvmk9x9ZlnZd7NyTA+nws4PcgAECDG6SCC43LP9y61KOO+Dt7ssaVKniwSaw1DBbvfwoLarsT5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.5	50010	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	716	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1705360586991&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1455862344158777 Date: Mon, 15 Jan 2024 23:16:27 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:28 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.5	50011	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	755	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360586999&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPU5UazBNMlV6TXpjdFpXUXlOQzAwWXpsbExXRTBZVGd0WTJFMVlqRmlaR001WmprMw cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 1004667571249038 Date: Mon, 15 Jan 2024 23:16:27 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:28 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.5	50016	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:27 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 137 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:27 UTC	137	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 33 38 30 34 33 39 39 34 36 37 39 37 32 37 37 35 38 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"380439946797277586"},"type":"trigger-no-matching-source"}]
2024-01-15 23:16:28 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:28 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.5	50020	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	983	OUT	GET /recaptcha/api2/aframe HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:28 UTC	847	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Mon, 15 Jan 2024 23:16:28 GMT Date: Mon, 15 Jan 2024 23:16:28 GMT Cache-Control: private, max-age=300 Content-Security-Policy: script-src 'report-sample' 'nonce-B1IkrhrF_dHvhI3G5g9Azw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:28 UTC	405	IN	Data Raw: 33 33 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 42 31 49 6b 72 68 72 46 5f 64 48 76 68 49 33 47 35 67 39 41 7a 77 22 3e 2f 2a 2a 20 41 6e 74 69 2d 66 72 61 75 64 20 61 6e 64 20 61 6e 74 69 2d 61 62 75 73 65 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 20 6f 6e 6c 79 2e 20 53 65 65 20 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 20 2a 2f 20 74 72 79 7b 76 61 72 20 63 6c 69 65 6e 74 73 3d 7b 27 73 6f 64 61 72 27 3a 27 68 Data Ascii: 33d<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="B1IkrhrF_dHvhI3G5g9Azw">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha */ try{var clients={'sodar':'h
2024-01-15 23:16:28 UTC	431	IN	Data Raw: 2e 64 61 74 61 29 3b 76 61 72 20 63 3d 63 6c 69 65 6e 74 73 5b 62 5b 27 69 64 27 5d 5d 3b 69 66 28 63 29 7b 76 61 72 20 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 6d 67 27 29 3b 64 2e 73 72 63 3d 63 2b 62 5b 27 70 61 72 61 6d 73 27 5d 2b 27 26 72 63 3d 27 2b 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 72 63 3a 3a 61 22 29 3f 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 72 63 3a 3a 62 22 29 3a 22 22 29 3b 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 72 63 3a 3a 65 22 2c 70 61 72 73 65 49 6e 74 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 Data Ascii: .data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorag
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.5	50022	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2656	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:28 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1be7a3a6f0860398&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdPPNZcG_18rCP34EnyOogU7oT3Si0SmMw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 22u6dtrdawrDv09KAmap8jpNjajQFbr-mctwO1jAyIwYlylWVcO5cA==
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.5	50021	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	4355	OUT	GET /pr_ue?action=visitation&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=996245b2-90e2-4786-a13b-818ee45c913d&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=358383407 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:28 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ce6ca3a6b47f03f9&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjnZaAgAuJCDd55CmjMKytNNkcf-aA9Uf4Q x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: SdnY1SxBb2YLvu95VO_okRtrwv7kRvikBGedRzNLf9qh2BK5ByjvNA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.5	50019	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1516	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20728&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=b4835f3e-f59e-4a99-a3c2-6f7565a3736a&ts=1705360586267&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	722	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:28 GMT access-control-allow-origin: * cache-control: no-cache, no-transform set-cookie: sc_at=v2\|H4sIAAAAAAAAAAXBgQ3AMAgDsIuQyAhtOKedxhUcPzuqL/iEdeMY3yzTddnZBMQPWZzB9ozlKY3/mk1CDTIAAAA=;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.5	50023	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2643	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:28 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d106a3a6b8ea00f0&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpyJmpGedaFWNh0lf3Q1HdzXByMk2Pd4o4 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: MCp15e9Db-TGQ02yqxnMYkvl_i__eDkoknaG3MVxsFlcugj7_qVQ7w==
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.5	50018	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:28 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 185 x-envoy-upstream-service-time: 35 server: API Gateway alt-svc: clear access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	185	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 31 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"1","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.5	50026	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2045	OUT	GET /gampad/ads?pvsid=1309977198800880&correlator=373666712671362&eid=31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D13b0a081-088a-4209-9757-61298c44974b%26affiliate_id%3D304142%26rendered_ad_pageview_id%3Dd7cca39c07340212%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie_enabled=1&abxe=1&dt=1705360582423&lmt=1705360582&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360582&ga_hid=273011141&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360568635&idt=8822&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1172277823&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:28 UTC	753	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Google-LineItem-Id: -2 Google-Creative-Id: -2 Google-MediationGroup-Id: -2 Google-MediationTag-Id: -2 Date: Mon, 15 Jan 2024 23:16:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:28 UTC	499	IN	Data Raw: 32 63 37 0d 0a 7b 22 2f 33 31 30 32 2f 62 63 6f 6d 2d 77 77 77 2f 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 2f 69 6e 64 65 78 2f 69 6e 64 65 78 2d 70 72 69 6d 61 72 79 22 3a 5b 22 68 74 6d 6c 22 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 35 30 2c 33 32 30 2c 31 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 22 49 44 3d 64 66 36 63 34 36 38 61 39 61 30 62 30 30 34 32 3a 54 3d 31 37 30 35 33 36 30 35 38 38 3a 52 54 3d 31 37 30 35 33 36 30 35 38 38 3a 53 3d 41 4c 4e 49 5f 4d 62 46 35 34 48 75 30 4d 41 65 36 64 6a 63 49 33 33 44 4e 39 58 34 64 64 30 42 35 41 22 2c 31 37 33 39 30 35 36 35 38 38 2c 22 2f 22 2c 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 31 5d 2c 5b 22 55 49 44 3d 30 30 30 30 30 64 62 37 38 39 38 33 64 62 61 35 3a 54 Data Ascii: 2c7{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,[["ID=df6c468a9a0b0042:T=1705360588:RT=1705360588:S=ALNI_MbF54Hu0MAe6djcI33DN9X4dd0B5A",1739056588,"/","booking.com",1],["UID=00000db78983dba5:T
2024-01-15 23:16:28 UTC	219	IN	Data Raw: 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 41 2d 56 34 71 50 69 6d 64 78 4f 31 76 30 72 55 4e 38 77 6d 6c 76 6c 4f 61 75 58 37 6c 34 53 71 55 36 72 39 78 50 68 54 4e 50 6f 50 79 57 34 49 38 39 69 57 57 2d 62 53 4b 70 6d 63 73 6e 55 68 47 6c 49 6e 5f 6c 49 6a 75 34 6d 55 6e 75 36 33 51 22 5d 7d 0a 0a 0d 0a Data Ascii: null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPimdxO1v0rUN8wmlvlOauX7l4SqU6r9xPhTNPoPyW4I89iWW-bSKpmcsnUhGlIn_lIju4mUnu63Q"]}
2024-01-15 23:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.5	50025	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	550	OUT	OPTIONS /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-api-version Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	803	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 13 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true access-control-max-age: 1800 access-control-allow-methods: GET,POST access-control-allow-headers: Accept,Accept-Encoding,Accept-Language,Connection,Content-Length,Content-Type,Host,Origin,Referer,User-Agent,X-Booking-API-Version,X-Booking-CSRF allow: POST,OPTIONS strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 95ad9d4dc596fb803e3114c8dbdc4b60.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: -JqOvh_IIreVfJytPg-BXPatlQn4tSG9xFp0KeFs6CqwG4SOUNdsfA==
2024-01-15 23:16:28 UTC	13	IN	Data Raw: 50 4f 53 54 2c 20 4f 50 54 49 4f 4e 53 Data Ascii: POST, OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.5	50030	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:28 GMT X-Cache: Error from cloudfront Via: 1.1 dc81af6f14945ade0fd126a735f82ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: D4xLSFoJAmbZfmTwVlsBH9XknmBd6NKtydw4HCPGAxVlgcsSFsVrow==
2024-01-15 23:16:28 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.5	50029	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1521	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20730&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=64c0dc5d-700a-4844-a35b-ecd5b1805a50&ts=1705360586269&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	685	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:28 GMT access-control-allow-origin: * cache-control: no-cache, no-transform set-cookie: sc_at=v2\|H4sIAAAAAAAAAA3KyREAIAgEsIqYWdBVLEc8qqB4zTsjLuiocngh1UmZYx0xj6m2tvawTO1gaT964gH59sCXMgAAAA==;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.5	50032	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1747	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360583869&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Ap_SPNf2SGelSq6yDZ5n29CFuxtgwUjlZgmKE0Vrz-dfIUb2&random=3730487843&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:28 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.5	50031	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1306	OUT	GET /pagead/1p-user-list/973712236/?random=1705360583943&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJkdp08dF56vb2yMr78z82SLuNqXlT16Sb9kMIyTl32QInD1&random=152987097&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:28 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:28 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.5	50033	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 86 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	86	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 64 37 63 63 61 33 39 63 30 37 33 34 30 32 31 32 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 32 2e 32 30 37 38 37 39 32 30 34 36 38 39 33 31 35 34 7d Data Ascii: {"pid":"d7cca39c07340212","refAction":"index","siteType":"1","cls":2.2078792046893154}
2024-01-15 23:16:28 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3fad6888361bd8bcd9c5b458635f78d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: p2_nDZ1dAy0JriLpkzqkII_23kMI2pGJIWPTNVgX928Q5TkvQ1e92Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.5	50034	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	685	OUT	GET /ct.html HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	363	IN	HTTP/1.1 200 OK Connection: close Content-Length: 565 cache-control: max-age=86400 content-type: text/html; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 4050180476678894 Date: Mon, 15 Jan 2024 23:16:28 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:28 UTC	565	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 50 69 6e 74 65 72 65 73 74 20 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 20 28 65 76 65 6e 74 29 20 3d 3e 20 7b 69 66 20 28 65 76 65 6e 74 2e 6f 72 69 67 69 6e 20 21 3d 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 22 29 20 7b 72 65 74 75 72 6e 3b 7d 74 72 79 20 7b 69 66 20 28 65 76 65 6e 74 2e 64 61 74 61 2e 6b 65 79 20 3d 3d 20 22 5f 65 70 69 6b 5f 6c 6f 63 61 6c 73 74 6f 72 65 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>Pinterest ct</title></head><body><div id="root"></div><script>window.addEventListener("message", (event) => {if (event.origin != "https://www.pinterest.com") {return;}try {if (event.data.key == "_epik_localstore

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.5	50037	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiRKiftgzRxkkrgTHXA66fizLzm7Toc47%2Bu9Sz2vKxHVRITESRFFL8A9o7GtfnO6xICaKhUeMFxT9xigHC%2BSJITZ8I2F69Ciru4yYCzSrUp9roGXIf5DdXo4%3D; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D
2024-01-15 23:16:29 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:28 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=65ada3a6469600c8&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuOmlXgVD3JzLCtAKkMW3emJVuAbXWIGYk x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: wrSDcYnUcfsvN7SXMFo7CwOCHBtymBauryG3zWbZIp3DePYJwH5New==
2024-01-15 23:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.5	50035	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1307	OUT	GET /pagead/1p-user-list/973712236/?random=1705360584011&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJJA0B8mwh_FiA7A2bDQpEqb-Y1IxSI-ZbbS-fjpIZYKQy3W&random=1176934799&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:29 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.5	50036	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1307	OUT	GET /pagead/1p-user-list/975716499/?random=1705360584036&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_JxYHjTeaGMCein85ILwo78MPCfdpKTootOlECM7PTT9XNEQu&random=2596020956&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:28 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:29 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.5	50038	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2035	OUT	GET /pagead/1p-conversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg&is_vtc=1&ocp_id=ybylZdS2LP25oPMPl9SGwAY&cid=CAQSKQAvHhf_6MyPeivjXG9NQFiUHvFpiH-bdHK0pXPJOVzHVDhkBUZ_CIUy&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nyjkNN3DKD3Ik-v9lvBOTd6pcmKXvc6N2K4&random=3129231315 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:29 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.5	50040	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	2656	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:29 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:29 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a1aaa3a6cc7700ad&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbwC-NOeKiIXVvEMAplhtBRXzN_bLN-qrg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: xObqf0QtrpuIVcSrGWrYTa83as6uYtnTT9P01EUqWT8GgxU4dk9UyA==
2024-01-15 23:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.5	50041	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1401	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360587004 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:28 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:28 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1295701415801314 Date: Mon, 15 Jan 2024 23:16:28 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:28 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.5	50039	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1307	OUT	GET /pagead/1p-user-list/975716499/?random=1705360584157&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_vL5iYH-X3Lfm-v4DQtUD5Qk1hGiiEYHtlL5rF7kIligLe8It&random=3186995343&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:29 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.5	50042	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1703	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360587815&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:29 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:28 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="; Expires=Tue, 14 Jan 2025 23:16:28 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 9113798418021290 Date: Mon, 15 Jan 2024 23:16:28 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:29 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.5	50043	172.253.63.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	1776	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je41a0v888381215z879615461&_p=1705360581642&_gaz=1&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2F&sid=1705360585&sct=1&seg=0&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2F&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&epn.cd_logged_in=0&ep.cd_tsmp=1705360582334&ep.cd_user_location=us&ep.cd_site_section=Stays&up.up_ga_client_id=810723182.1705360577&upn.up_is_subscribed_to_newsletter=0&tfd=19840 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Mon, 15 Jan 2024 23:16:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.5	50044	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:28 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:29 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:29 GMT X-Cache: Error from cloudfront Via: 1.1 0f954bea3b233fb0b6e1981b1e8b6bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: F7eNfRFPbFlCLV7eeEljMJND3_qRqzDs0kxekDIHt4O5-QukIrP2gA==
2024-01-15 23:16:29 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.5	50045	142.251.111.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	885	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&cid=810723182.1705360577&gtm=45je41a0v888381215z879615461&aip=1&dma=0&gcs=G1--&gcd=11l1l1l1l5 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:29 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Mon, 15 Jan 2024 23:16:29 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.5	50048	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	721	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 892 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAA3KyREAIAgEsIqYWdBVLEc8qqB4zTsjLuiocngh1UmZYx0xj6m2tvawTO1gaT964gH59sCXMgAAAA==
2024-01-15 23:16:29 UTC	892	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 61 30 30 33 63 36 34 30 2d 66 65 37 34 2d 34 36 38 38 2d 39 34 35 64 2d 34 38 38 34 39 38 66 36 37 35 37 63 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"a003c640-fe74-4688-945d-488498f6757c","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","df":true,"s
2024-01-15 23:16:29 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:29 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.5	50047	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	721	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8477 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAA3KyREAIAgEsIqYWdBVLEc8qqB4zTsjLuiocngh1UmZYx0xj6m2tvawTO1gaT964gH59sCXMgAAAA==
2024-01-15 23:16:29 UTC	8477	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 38 65 34 34 30 66 35 65 2d 39 35 39 62 2d 34 30 66 36 2d 38 62 62 65 2d 66 62 63 65 30 36 38 39 37 61 31 66 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"8e440f5e-959b-40f6-8bbe-fbce06897a1f","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","df":true,"s
2024-01-15 23:16:29 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:29 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.5	50051	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:29 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:29 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=499ea3a6d6360020&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstbvTelay4qtWIMriBRLBUzYhykVNkp_Js x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: wSc2xniCQnHJcheQSDsyjh0A0B-gWTPLNIkh605j91vdd2fU3ooDvg==
2024-01-15 23:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.5	50050	3.162.129.245	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	573	OUT	GET /scevent.min.js HTTP/1.1 Host: sc-static.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://tr.snapchat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: X-AB=dc4e3509882e40c68a170453af779220
2024-01-15 23:16:29 UTC	570	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 42390 Connection: close Server: CloudFront Date: Mon, 15 Jan 2024 22:54:15 GMT Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Origin: * Content-Encoding: utf-8 Cache-Control: public, s-maxage=86400, max-age=600 ETag: dc4e3509882e40c68a170453af779220 X-Cache: Hit from cloudfront Via: 1.1 f3131b940cd6fd6a885d42f83a5b3a42.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: kolXMYup0MEj34O_kiMIERtpkw-akJEnOqA9uLShE1dJFHVMeub0YQ== Age: 1334
2024-01-15 23:16:29 UTC	15814	IN	Data Raw: 2f 2a 2a 20 53 6e 61 70 63 68 61 74 20 50 69 78 65 6c 20 53 44 4b 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 2c 72 3d 31 2c 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 3c 65 3b 72 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 69 29 26 26 28 6e 5b 69 5d 3d 74 5b 69 5d 29 3b 72 65 74 75 72 6e 20 6e 7d 2c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 Data Ascii: /** Snapchat Pixel SDK */!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,argu
2024-01-15 23:16:29 UTC	16384	IN	Data Raw: 69 66 28 63 28 6e 29 26 26 21 66 28 74 2c 6e 29 29 7b 4f 28 74 2c 6e 29 3b 76 61 72 20 72 3d 22 22 3b 69 66 28 54 28 6e 2e 74 6f 4a 53 4f 4e 29 29 72 65 74 75 72 6e 20 50 72 28 6e 2e 74 6f 4a 53 4f 4e 28 29 29 3b 69 66 28 6f 28 6e 29 29 7b 66 6f 72 28 76 61 72 20 65 3d 44 28 6e 29 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 7b 72 2b 3d 28 69 3f 22 2c 22 3a 22 22 29 2b 28 28 73 3d 50 72 28 6e 5b 69 5d 29 29 7c 7c 22 6e 75 6c 6c 22 29 7d 72 65 74 75 72 6e 22 5b 22 2b 72 2b 22 5d 22 7d 69 3d 30 3b 66 6f 72 28 76 61 72 20 75 20 69 6e 20 6e 29 7b 76 61 72 20 73 3b 28 73 3d 50 72 28 6e 5b 75 5d 29 29 26 26 28 72 2b 3d 28 69 3f 27 2c 22 27 3a 27 22 27 29 2b 75 2b 27 22 3a 27 2b 73 2c 69 2b 2b 29 7d 72 65 74 75 72 6e 22 7b 22 2b 72 2b 22 7d 22 7d 69 66 28 61 28 6e 29 Data Ascii: if(c(n)&&!f(t,n)){O(t,n);var r="";if(T(n.toJSON))return Pr(n.toJSON());if(o(n)){for(var e=D(n),i=0;i<e;i++){r+=(i?",":"")+((s=Pr(n[i]))\|\|"null")}return"["+r+"]"}i=0;for(var u in n){var s;(s=Pr(n[u]))&&(r+=(i?',"':'"')+u+'":'+s,i++)}return"{"+r+"}"}if(a(n)
2024-01-15 23:16:29 UTC	10192	IN	Data Raw: 74 5b 70 5d 2b 22 2c 22 3a 22 22 29 2b 58 72 28 6c 29 7d 7d 63 61 74 63 68 28 6e 29 7b 77 6e 28 22 41 53 43 50 4d 22 2c 6e 29 7d 44 28 6e 6e 28 74 29 29 3e 31 26 26 41 6e 28 7b 70 63 3a 74 7d 29 7d 28 6e 29 7d 29 29 29 2c 21 21 74 7d 63 61 74 63 68 28 74 29 7b 77 6e 28 22 41 4d 41 4c 22 2c 74 2c 6e 2e 77 61 74 63 68 5f 65 6c 29 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 53 69 28 6e 29 7b 74 72 79 7b 69 66 28 21 6d 69 28 6e 29 29 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 65 3d 4b 28 29 2c 69 3d 65 28 72 29 3b 74 72 79 7b 76 61 72 20 6f 3d 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 65 2e 73 65 6e 64 29 3b 6f 2e 6f 62 73 65 72 76 65 28 6e 2c 74 29 2c 69 2e 6f 6e 28 28 66 75 6e 63 74 69 6f Data Ascii: t[p]+",":"")+Xr(l)}}catch(n){wn("ASCPM",n)}D(nn(t))>1&&An({pc:t})}(n)}))),!!t}catch(t){wn("AMAL",t,n.watch_el)}return!0}function Si(n){try{if(!mi(n))var t=function(n,t,r){var e=K(),i=e(r);try{var o=new MutationObserver(e.send);o.observe(n,t),i.on((functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.5	50053	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	2656	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:29 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:29 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a4a2a3a63ea704cc&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGeoK_CwyXLLQHeoxStR9BMkRva_TsOAqlg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CVLj3k7sErAM5VtrEYCLMdUjxpsxzjFVyALMMehChc3nyIGZtQJayw==
2024-01-15 23:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.5	50052	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	1024	OUT	GET /js/bg/0Cqmw64vVDdXjGZEoSN2NjFc6s-AADeaJ1f3yoXUl2A.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 17042 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 15 Jan 2024 19:54:53 GMT Expires: Tue, 14 Jan 2025 19:54:53 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 03 Jan 2024 11:00:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 12096 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:29 UTC	441	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 4c 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 66 7d 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 46 29 7b 69 66 28 21 28 46 3d 28 66 3d 6e 75 6c 6c 2c 63 2e 74 72 75 73 74 65 64 54 79 70 65 73 29 2c 46 29 7c 7c 21 46 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 66 3b 74 72 79 7b 66 3d 46 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var c=this\|\|self,L=function(f){return f},P=function(f,F){if(!(F=(f=null,c.trustedTypes),F)\|\|!F.createPolicy)return f;try{f=F.createPolicy("bg",{createHTM
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 53 63 72 69 70 74 28 72 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 22 22 2b 72 7d 7d 28 63 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 46 46 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 2c 63 2c 4c 2c 59 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 7d 72 65 74 75 72 6e 20 59 3d 28 4c 3d 28 46 3d 66 70 28 46 2c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 61 26 26 28 66 26 26 58 28 66 29 2c 63 3d 72 2c 61 28 29 2c 61 3d 76 6f 69 64 20 30 29 7d 2c 21 21 28 63 3d 76 6f 69 64 20 30 2c 66 29 29 2c 46 29 5b 31 5d 2c 46 5b 30 5d 29 2c 7b 69 6e 76 6f 6b 65 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 50 2c 70 2c 6d 29 Data Ascii: .createScript(r)}:function(r){return""+r}}(c)(Array(7824*Math.random()\|0).join("\n")+'(function(){var FF=function(F,f,c,L,Y){function a(){}return Y=(L=(F=fp(F,function(r){a&&(f&&X(f),c=r,a(),a=void 0)},!!(c=void 0,f)),F)[1],F[0]),{invoke:function(r,P,p,m)
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 36 33 32 30 3d 3d 28 46 2e 63 68 61 72 43 6f 64 65 41 74 28 63 2b 31 29 26 36 34 35 31 32 29 3f 28 59 3d 36 35 35 33 36 2b 28 28 59 26 31 30 32 33 29 3c 3c 31 30 29 2b 28 46 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 63 29 26 31 30 32 33 29 2c 4c 5b 66 2b 2b 5d 3d 59 3e 3e 31 38 7c 32 34 30 2c 4c 5b 66 2b 2b 5d 3d 59 3e 3e 31 32 26 36 33 7c 31 32 38 29 3a 4c 5b 66 2b 2b 5d 3d 59 3e 3e 31 32 7c 32 32 34 2c 4c 5b 66 2b 2b 5d 3d 59 3e 3e 36 26 36 33 7c 31 32 38 29 2c 4c 5b 66 2b 2b 5d 3d 59 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 4c 7d 2c 55 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 29 7b 66 6f 72 28 66 3d 5b 5d 3b 46 2d 2d 3b 29 66 2e 70 75 73 68 28 32 35 35 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 3b 72 65 74 75 72 6e 20 66 7d 2c 4e 3d 66 75 Data Ascii: 6320==(F.charCodeAt(c+1)&64512)?(Y=65536+((Y&1023)<<10)+(F.charCodeAt(++c)&1023),L[f++]=Y>>18\|240,L[f++]=Y>>12&63\|128):L[f++]=Y>>12\|224,L[f++]=Y>>6&63\|128),L[f++]=Y&63\|128);return L},U=function(F,f){for(f=[];F--;)f.push(255*Math.random()\|0);return f},N=fu
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 2c 63 2c 4c 2c 59 2c 61 2c 72 2c 50 29 7b 72 65 74 75 72 6e 28 72 3d 28 66 3d 5b 38 30 2c 28 61 3d 67 4a 2c 2d 36 33 29 2c 36 2c 35 35 2c 28 50 3d 46 26 37 2c 37 36 29 2c 37 39 2c 66 2c 2d 33 32 2c 37 35 2c 39 37 5d 2c 75 5b 63 2e 4c 5d 28 63 2e 43 73 29 29 2c 72 29 5b 63 2e 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 59 3d 28 50 2b 3d 36 2b 37 2a 46 2c 70 29 2c 50 26 3d 37 7d 2c 72 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 70 29 7b 72 65 74 75 72 6e 28 70 3d 28 59 3d 28 70 3d 33 35 39 31 2a 4c 2a 28 70 3d 4c 25 31 36 2b 31 2c 59 29 2b 28 61 28 29 7c 30 29 2a 70 2d 31 31 34 2a 4c 2a 4c 2a 59 2d 20 2d 31 36 35 33 2a 59 2d 70 2a 59 2b 32 2a 4c 2a 4c 2a 70 2b 66 5b 50 2b 36 37 26 37 5d 2a 4c 2a 70 2b 35 37 2a Data Ascii: =function(F,f,c,L,Y,a,r,P){return(r=(f=[80,(a=gJ,-63),6,55,(P=F&7,76),79,f,-32,75,97],u[c.L](c.Cs)),r)[c.L]=function(p){Y=(P+=6+7F,p),P&=7},r.concat=function(p){return(p=(Y=(p=3591L(p=L%16+1,Y)+(a()\|0)p-114LLY- -1653Y-pY+2LLp+f[P+67&7]Lp+57*
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 29 2e 6c 65 6e 67 74 68 7c 7c 46 2e 75 2e 63 72 65 61 74 65 28 29 2e 6c 65 6e 67 74 68 7c 7c 28 46 2e 75 3d 76 6f 69 64 20 30 2c 46 2e 68 3d 76 6f 69 64 20 30 29 2c 66 7d 2c 71 32 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 2c 63 29 7b 72 65 74 75 72 6e 20 66 2e 4f 28 66 75 6e 63 74 69 6f 6e 28 4c 29 7b 63 3d 4c 7d 2c 66 61 6c 73 65 2c 46 29 2c 63 7d 2c 47 44 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 29 7b 72 65 74 75 72 6e 20 66 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 3c 46 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 46 5b 66 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 28 66 3d 66 2e 50 5b 46 5d 2c 66 29 29 Data Ascii: ).length\|\|F.u.create().length\|\|(F.u=void 0,F.h=void 0),f},q2=function(F,f,c){return f.O(function(L){c=L},false,F),c},GD=function(F,f){return f=0,function(){return f<F.length?{done:false,value:F[f++]}:{done:true}}},J=function(F,f){if(void 0===(f=f.P[F],f))
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 68 66 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 2c 63 2c 4c 29 7b 74 72 79 7b 4c 3d 46 5b 28 28 66 7c 30 29 2b 32 29 25 33 5d 2c 46 5b 66 5d 3d 28 46 5b 66 5d 7c 30 29 2d 28 46 5b 28 28 66 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 4c 7c 30 29 5e 28 31 3d 3d 66 3f 4c 3c 3c 63 3a 4c 3e 3e 3e 63 29 7d 63 61 74 63 68 28 59 29 7b 74 68 72 6f 77 20 59 3b 7d 7d 2c 4b 70 3d 66 75 6e 63 74 69 6f 6e 28 46 29 7b 72 65 74 75 72 6e 20 46 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 2c 63 2c 4c 2c 59 2c 61 29 7b 69 66 28 63 2e 54 2e 6c 65 6e 67 74 68 29 7b 63 2e 5a 3d 28 63 2e 62 5a 3d 28 63 2e 5a 26 26 30 28 29 2c 46 29 2c 74 72 75 65 29 3b 74 72 79 7b 4c 3d 63 2e 43 28 29 2c 63 2e 4e 3d 4c 2c 63 2e 46 3d 4c 2c 63 2e 52 3d 30 2c 59 3d 6e 70 28 63 2c 46 29 2c 61 3d 63 Data Ascii: hf=function(F,f,c,L){try{L=F[((f\|0)+2)%3],F[f]=(F[f]\|0)-(F[((f\|0)+1)%3]\|0)-(L\|0)^(1==f?L<<c:L>>>c)}catch(Y){throw Y;}},Kp=function(F){return F},I=function(F,f,c,L,Y,a){if(c.T.length){c.Z=(c.bZ=(c.Z&&0(),F),true);try{L=c.C(),c.N=L,c.F=L,c.R=0,Y=np(c,F),a=c
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 72 2c 50 2c 70 29 7b 28 50 3d 28 70 3d 28 50 3d 48 28 28 70 3d 48 28 72 29 2c 72 29 29 2c 30 21 3d 4a 28 70 2c 72 29 29 2c 4a 29 28 50 2c 72 29 2c 70 29 26 26 47 28 72 2c 31 31 33 2c 50 29 7d 2c 28 47 28 66 2c 28 54 28 33 31 31 2c 66 75 6e 63 74 69 6f 6e 28 72 2c 50 2c 70 29 7b 77 28 72 2c 66 61 6c 73 65 2c 50 2c 74 72 75 65 29 7c 7c 28 50 3d 48 28 72 29 2c 70 3d 48 28 72 29 2c 47 28 72 2c 70 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 72 65 74 75 72 6e 20 65 76 61 6c 28 6d 29 7d 28 41 66 28 4a 28 50 2c 72 2e 69 29 29 29 29 29 7d 2c 28 54 28 38 36 2c 66 75 6e 63 74 69 6f 6e 28 72 2c 50 2c 70 2c 6d 2c 4d 2c 42 29 7b 77 28 72 2c 66 61 6c 73 65 2c 50 2c 74 72 75 65 29 7c 7c 28 4d 3d 49 7a 28 72 2e 69 29 2c 50 3d 4d 2e 41 55 2c 42 3d 4d 2e 7a 45 2c 6d 3d 4d 2e 76 Data Ascii: r,P,p){(P=(p=(P=H((p=H(r),r)),0!=J(p,r)),J)(P,r),p)&&G(r,113,P)},(G(f,(T(311,function(r,P,p){w(r,false,P,true)\|\|(P=H(r),p=H(r),G(r,p,function(m){return eval(m)}(Af(J(P,r.i)))))},(T(86,function(r,P,p,m,M,B){w(r,false,P,true)\|\|(M=Iz(r.i),P=M.AU,B=M.zE,m=M.v
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 5a 3d 66 61 6c 73 65 2c 66 29 2e 4b 73 3d 61 2e 74 69 6d 65 4f 72 69 67 69 6e 7c 7c 28 61 2e 74 69 6d 69 6e 67 7c 7c 7b 7d 29 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7c 7c 30 2c 66 2e 53 3d 76 6f 69 64 20 30 2c 66 61 6c 73 65 29 2c 30 29 29 2c 30 29 29 2c 66 75 6e 63 74 69 6f 6e 28 72 2c 50 2c 70 2c 6d 29 7b 69 66 28 50 3d 72 2e 6c 2e 70 6f 70 28 29 29 7b 66 6f 72 28 6d 3d 74 28 72 29 3b 30 3c 6d 3b 6d 2d 2d 29 70 3d 48 28 72 29 2c 50 5b 70 5d 3d 72 2e 50 5b 70 5d 3b 50 5b 34 33 38 5d 3d 72 2e 50 5b 34 33 38 5d 2c 50 5b 32 35 33 5d 3d 72 2e 50 5b 32 35 33 5d 2c 72 2e 50 3d 50 7d 65 6c 73 65 20 47 28 72 2c 31 31 33 2c 72 2e 44 29 7d 29 2c 66 29 2c 31 31 37 29 29 2c 66 29 2e 5a 61 3d 30 2c 66 29 29 2c 34 39 39 29 2c 5b 5d 29 2c 33 33 31 29 2c 30 29 Data Ascii: Z=false,f).Ks=a.timeOrigin\|\|(a.timing\|\|{}).navigationStart\|\|0,f.S=void 0,false),0)),0)),function(r,P,p,m){if(P=r.l.pop()){for(m=t(r);0<m;m--)p=H(r),P[p]=r.P[p];P[438]=r.P[438],P[253]=r.P[253],r.P=P}else G(r,113,r.D)}),f),117)),f).Za=0,f)),499),[]),331),0)
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 29 50 2e 70 75 73 68 28 74 28 72 29 29 3b 47 28 72 2c 6d 2c 50 29 7d 29 2c 66 29 2c 66 29 29 2c 31 38 30 29 2c 7b 7d 29 2c 66 29 29 2c 30 29 29 2c 54 29 28 34 36 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 66 29 2c 34 35 31 29 2c 66 75 6e 63 74 69 6f 6e 28 72 2c 50 2c 70 2c 6d 2c 4d 2c 42 2c 67 2c 78 2c 68 2c 41 2c 53 2c 4f 29 7b 66 75 6e 63 74 69 6f 6e 20 79 28 71 2c 43 29 7b 66 6f 72 28 3b 6d 3c 71 3b 29 68 7c 3d 74 28 72 29 3c 3c 6d 2c 6d 2b 3d 38 3b 72 65 74 75 72 6e 20 68 3e 3e 3d 28 43 3d 68 26 28 31 3c 3c 71 29 2d 28 6d 2d 3d 71 2c 31 29 2c 71 29 2c 43 7d 66 6f 72 28 41 3d 28 53 3d 28 6d 3d 68 3d 28 67 3d 48 28 72 29 2c 30 29 2c 79 28 33 29 7c 30 29 2b 31 2c 70 3d 79 28 35 29 2c 50 3d 42 3d 30 2c 5b 5d 29 3b 42 3c 70 3b 42 2b 2b 29 4f 3d 79 28 31 Data Ascii: )P.push(t(r));G(r,m,P)}),f),f)),180),{}),f)),0)),T)(460,function(){},f),451),function(r,P,p,m,M,B,g,x,h,A,S,O){function y(q,C){for(;m<q;)h\|=t(r)<<m,m+=8;return h>>=(C=h&(1<<q)-(m-=q,1),q),C}for(A=(S=(m=h=(g=H(r),0),y(3)\|0)+1,p=y(5),P=B=0,[]);B<p;B++)O=y(1
2024-01-15 23:16:29 UTC	1252	IN	Data Raw: 5b 74 68 69 73 2e 48 2e 6c 65 6e 67 74 68 3e 3e 31 5d 5d 7d 2c 66 75 6e 63 74 69 6f 6e 28 4c 2c 59 29 7b 28 74 68 69 73 2e 6e 2b 2b 2c 35 30 29 3e 74 68 69 73 2e 48 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 48 2e 70 75 73 68 28 4c 29 3a 28 59 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 74 68 69 73 2e 6e 29 2c 35 30 3e 59 26 26 28 74 68 69 73 2e 48 5b 59 5d 3d 4c 29 29 7d 29 2c 63 29 2c 46 3d 6e 65 77 20 63 2c 66 75 6e 63 74 69 6f 6e 28 4c 29 7b 72 65 74 75 72 6e 20 4c 3d 66 2e 54 45 28 29 2e 63 6f 6e 63 61 74 28 46 2e 54 45 28 29 29 2c 46 3d 6e 65 77 20 63 2c 4c 7d 29 5d 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 46 2c 66 29 7b 69 66 28 46 2e 68 29 72 65 74 75 72 6e 20 58 46 28 46 2c 46 2e 75 29 3b 72 65 74 75 72 6e 28 66 3d 65 Data Ascii: [this.H.length>>1]]},function(L,Y){(this.n++,50)>this.H.length?this.H.push(L):(Y=Math.floor(Math.random()*this.n),50>Y&&(this.H[Y]=L))}),c),F=new c,function(L){return L=f.TE().concat(F.TE()),F=new c,L})]},H=function(F,f){if(F.h)return XF(F,F.u);return(f=e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.5	50055	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	1036	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:29 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Mon, 15 Jan 2024 23:16:29 GMT Date: Mon, 15 Jan 2024 23:16:29 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:29 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js');
2024-01-15 23:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.5	50059	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:29 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:30 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:30 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3320a3a720740328&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvarBSdkHd4Os0AcFrFrLFpOvZnnzIOVAE x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f9efe5e72b7e5cc47bf34a0b0debcbe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: y_wOqr6lwWOQgXYoeV-6Hy-jNtDFrXS_gs5cF1Co4zm_oZTMUqx-Zw==
2024-01-15 23:16:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.5	50060	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:30 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2828 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:30 UTC	2828	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 66 34 61 69 78 61 73 58 41 41 41 41 3a 54 7a 66 37 71 45 75 4a 4a 6e 6a 2f 6f 75 43 6b 4c 39 48 72 30 4c 5a 4a 41 79 55 6f 42 47 38 4e 4f 4d 54 47 71 75 6d 78 44 39 4f 41 4d 4a 41 4b 6a 74 53 47 5a 6a 59 31 37 63 7a 51 47 37 6a 79 45 68 5a 6f 46 38 71 33 67 33 34 61 68 38 38 71 79 31 6e 77 59 6d 2b 6e 77 57 59 31 73 44 6f 74 45 76 33 61 45 43 77 32 65 72 43 61 48 4e 5a 51 58 32 7a 6e 43 6c 76 6d 6b 39 78 39 5a 6c 6e 5a 64 37 4e 79 54 41 2b 6e 77 73 34 50 63 67 41 45 43 44 47 36 53 43 43 34 33 4c 50 39 79 36 31 4b 4f 4f 2b 44 74 37 73 73 61 56 4b 6e 69 77 53 61 77 31 44 42 62 76 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAf4aixasXAAAA:Tzf7qEuJJnj/ouCkL9Hr0LZJAyUoBG8NOMTGqumxD9OAMJAKjtSGZjY17czQG7jyEhZoF8q3g34ah88qy1nwYm+nwWY1sDotEv3aECw2erCaHNZQX2znClvmk9x9ZlnZd7NyTA+nws4PcgAECDG6SCC43LP9y61KOO+Dt7ssaVKniwSaw1DBbv
2024-01-15 23:16:30 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1477 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:30 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcce-5fabc03809e2999b206e94ad X-Cache: Miss from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: JTY6roQXvATp7wg7mklNAVVL3HzGFD6zej4vGFFzUgzZ6WrIGQk2jQ==
2024-01-15 23:16:30 UTC	1477	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 71 39 71 69 33 2b 30 66 41 41 41 41 3a 6e 62 6b 79 65 51 47 32 53 66 2f 6b 56 32 41 39 52 46 6b 42 64 6e 33 56 4f 4d 69 72 6a 6b 70 5a 66 4e 4e 53 76 5a 58 69 72 4e 41 4a 32 4a 4a 31 36 30 56 78 49 37 6c 35 6a 39 43 59 53 43 36 6d 32 31 38 51 55 6d 68 57 74 73 2b 59 34 6e 54 4c 67 75 7a 4a 6c 49 6e 63 55 48 4d 72 77 32 4f 32 78 4a 48 79 6a 31 6f 73 62 57 67 6f 38 58 53 55 76 74 45 6b 64 68 2b 36 6e 31 62 6f 7a 30 6a 55 6c 38 64 4f 72 77 70 79 33 74 78 64 2b 4b 49 56 48 50 69 5a 56 6f 71 63 4e 6c 61 54 47 42 5a 55 36 50 77 59 74 49 55 71 49 6c 59 43 45 34 4b 73 6e 7a 76 61 32 61 72 79 7a 50 41 6f 65 68 30 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.5	50061	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:30 UTC	1056	OUT	GET /cm/s?bt=1d53c387&pnid=140&cb=1705360589537&u_scsid=a07a2f88-949f-4262-a700-8aa298b10549&u_sclid=a450d900-cc30-455d-b706-0e1ea9752a68 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://tr.snapchat.com/cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAA3KyREAIAgEsIqYWdBVLEc8qqB4zTsjLuiocngh1UmZYx0xj6m2tvawTO1gaT964gH59sCXMgAAAA==
2024-01-15 23:16:30 UTC	779	IN	HTTP/1.1 302 Found date: Mon, 15 Jan 2024 23:16:30 GMT location: https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1705040131734%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D set-cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 3 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.5	50062	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:30 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:30 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:30 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7ef9a3a77e840031&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvz9onRupbWgSJOZSKF3KZr9oGHBJemVG0 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CIPyNLatTVUjfl4dFm-0F_cIcM7I10zS3FFYwFZvzr2DureAz-HiJA==
2024-01-15 23:16:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.5	50063	34.111.113.62	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:30 UTC	825	OUT	GET /idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1705040131734%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP/1.1 Host: pixel.tapad.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://tr.snapchat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:31 UTC	200	IN	HTTP/1.1 403 Forbidden Content-Length: 134 Content-Type: text/html; charset=UTF-8 Date: Mon, 15 Jan 2024 23:16:31 GMT Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:31 UTC	134	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 34 30 33 3c 2f 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e Data Ascii: <!doctype html><meta charset="utf-8"><meta name=viewport content="width=device-width, initial-scale=1"><title>403</title>403 Forbidden

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.5	50064	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:31 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=fe4aa3a7b76b0014&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvlKfrcTOMf-UKyV8DO5a0j-G6NgkXr0rU x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: gc3uiYMjt6-5GlQK7CHhNI0PwFY5kDyS-_dfgG82QxC8-nuTLxKSVw==
2024-01-15 23:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.5	50066	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	3852	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:31 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=395ca3a7260a001e&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLOlQxdg-eKCKPK2i42Wbf3oEWYsFkfIBw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: HiwlWhMMFgSUu5VmRaWahKYTh9I6OzSNeECUmDvBjZDYjXID9gtmQw==
2024-01-15 23:16:31 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.5	50067	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:31 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7965a3a71b880085&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp4oYVPQ-oHkOtfIne1QRdkSMfVWgiYKeb x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ANuoDFpxRfYwzOPdw5cHHSKZReOEy6EY1Mbzoa7rcDAbYeAxfKtjFQ==
2024-01-15 23:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.5	50069	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	3359	OUT	GET /js_errors?pid=d7cca39c07340212&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c-&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:31 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5060a3a7345204f1&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpsiMALZQJdcYZvoybP3IpWizR8Oe-4tXS x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: RuuyZ9NEmXChih6cT6bGDNr5z_b1F9f7xzSTiuuU4wc9kdtfWvV8nw==
2024-01-15 23:16:31 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.5	50070	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2738	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:31 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6f6ca3a77b38033b&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVnvOSzNGCt3-HyOqSRT7ENL6pyTx6uwEw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: MGX875XoxDisUXpDJFCuLLh8F2md7mWenPN2cFKa84ylm-EYpCUmNg==
2024-01-15 23:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.5	50072	216.239.34.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2735	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360581642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&_fplc=0&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=1523317164.1705360584&sst.gcd=11l1l1l1l5&sst.tft=1705360581642&_s=1&sid=1705360585&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=19904&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ
2024-01-15 23:16:31 UTC	688	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly set-cookie: FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; Max-Age=72000; Domain=booking.com; Path=/; Secure cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: 99dc57e58a57bf57d8bdb7255ec14b84 Date: Mon, 15 Jan 2024 23:16:31 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:31 GMT Connection: close
2024-01-15 23:16:31 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.5	50071	172.253.115.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1152	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:31 UTC	2214	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:31 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"2144838804951865473"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"380439946797277586","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"2144838804951865473","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"2144838804951865473","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"2144838804951865473","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"2144838804951865473","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:16:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.5	50073	13.249.39.47	443

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:31 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a332a3a741de01b5&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu2hMfsGrRdC2_XAZtK8i5WCd6Pkc9dP44 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: H-NQ8SwGOgowt0ADi_LI909d2ScfaPMiXArNN1fjx3Ipi84XjIO-BA==
2024-01-15 23:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.5	50076	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:31 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:31 GMT X-Cache: Error from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9xQhe9EbcaTj0cZJrJqW8gTzzW7O5oHtu0qUJ3E__kyEvPd17O0_kw==
2024-01-15 23:16:31 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.5	50077	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2966	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=d7cca39c07340212&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000
2024-01-15 23:16:32 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=60e3a3a793940165&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLwQwIXJ1JytbO2rZ5B3Ro4C5ejFpsu5RE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: LPIeyED_QhZHH2jspidlGKsZb1Y5P1_8puGT1vjdW2D65G_geCbh6g==
2024-01-15 23:16:32 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.5	50074	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1055	OUT	GET /pagead/1p-user-list/988382855/?random=1705360583484&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_xliVs_MDyw-B6DZ1oXHSkYdYBWCxlg&random=2826677896&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.5	50075	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1128	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 9221 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=drgogwuv3d4i Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:31 UTC	9221	OUT	Data Raw: 0a 18 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 12 8e 0f 30 33 41 46 63 57 65 41 36 6c 75 39 4c 42 61 5f 79 76 34 4f 51 47 78 76 6e 66 4c 6e 44 48 6a 30 6a 6f 38 45 7a 62 74 4c 43 65 4b 70 2d 75 30 4d 31 49 76 5a 71 4e 6a 74 6e 78 72 67 76 33 31 36 63 4b 62 36 6c 72 57 54 49 72 5a 6a 53 58 55 38 4d 68 57 53 41 55 74 39 2d 52 4e 58 75 45 70 35 4a 42 44 4f 31 66 35 78 42 70 58 46 54 50 6a 73 34 67 55 34 37 78 78 67 66 5a 67 68 36 6c 51 31 58 47 4f 6b 48 59 66 31 30 68 62 34 44 55 2d 51 42 63 63 73 62 53 52 33 64 67 30 6e 4b 39 43 7a 30 47 42 5a 77 30 74 73 41 5f 57 75 75 78 63 33 4a 76 41 32 5a 42 4d 47 34 71 76 56 4e 2d 36 4a 35 48 6a 6e 69 42 51 4a 70 67 51 56 64 67 7a 6a 6d 41 5a 6b 2d 50 53 54 65 78 70 49 42 43 49 70 76 4f Data Ascii: u-xcq3POCWFlCr3x8_IPxgPu03AFcWeA6lu9LBa_yv4OQGxvnfLnDHj0jo8EzbtLCeKp-u0M1IvZqNjtnxrgv316cKb6lrWTIrZjSXU8MhWSAUt9-RNXuEp5JBDO1f5xBpXFTPjs4gU47xxgfZgh6lQ1XGOkHYf10hb4DU-QBccsbSR3dg0nK9Cz0GBZw0tsA_Wuuxc3JvA2ZBMG4qvVN-6J5HjniBQJpgQVdgzjmAZk-PSTexpIBCIpvO
2024-01-15 23:16:32 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 15 Jan 2024 23:16:32 GMT Expires: Mon, 15 Jan 2024 23:16:32 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI;Path=/recaptcha;Expires=Sat, 13-Jul-2024 23:16:32 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:32 UTC	556	IN	Data Raw: 61 38 33 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 71 34 73 55 61 48 41 74 79 56 66 31 67 7a 41 7a 7a 7a 4b 66 72 6d 6b 44 46 31 70 61 62 6d 38 36 41 6a 58 72 58 35 42 44 31 6a 30 51 6c 70 53 6a 45 70 52 54 31 46 61 55 43 37 6d 54 50 65 70 64 45 39 6c 76 45 39 58 45 7a 76 76 5a 6d 46 4c 70 77 5a 4f 72 73 66 4b 54 31 66 6f 61 64 31 76 32 5a 4e 35 79 35 6f 71 4e 72 52 65 65 66 77 5a 65 78 6c 46 6f 53 6f 78 51 54 6c 62 74 51 6e 6b 4a 43 32 38 61 6c 65 5a 4e 63 47 44 68 47 65 33 6b 6d 4f 57 42 33 45 4d 6c 78 48 51 56 4a 51 72 61 4a 38 66 37 71 4e 47 61 4a 48 57 44 69 4b 54 63 79 69 72 6d 71 30 41 65 79 39 4d 41 73 75 6c 70 47 6f 6a 5f 77 43 64 33 37 4c 63 41 36 30 59 31 7a 54 67 31 65 73 37 37 70 64 5a 63 77 6c 53 4e 37 59 Data Ascii: a83)]}'["rresp","03AFcWeA6q4sUaHAtyVf1gzAzzzKfrmkDF1pabm86AjXrX5BD1j0QlpSjEpRT1FaUC7mTPepdE9lvE9XEzvvZmFLpwZOrsfKT1foad1v2ZN5y5oqNrReefwZexlFoSoxQTlbtQnkJC28aleZNcGDhGe3kmOWB3EMlxHQVJQraJ8f7qNGaJHWDiKTcyirmq0Aey9MAsulpGoj_wCd37LcA60Y1zTg1es77pdZcwlSN7Y
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 52 4b 4e 64 53 54 69 50 52 47 65 4b 55 69 4b 33 69 33 59 6b 76 31 54 46 36 73 74 53 68 46 53 32 6f 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 22 2c 22 22 2c 22 59 31 6c 43 4e 47 4e 5a 54 48 56 4d 51 7a 64 49 61 48 6c 46 63 48 45 32 55 30 35 77 54 6c 70 4d 4e 32 4e 74 52 54 4e 7a 4e 47 74 78 63 30 78 56 4b 32 68 4a 4d 45 78 6a 5a 57 52 51 59 31 46 69 63 55 4a 6b 5a 79 74 6e 62 58 46 71 54 57 35 51 63 6c 70 74 53 6a 46 Data Ascii: RKNdSTiPRGeKUiK3i3Ykv1TF6stShFS2o",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz","","Y1lCNGNZTHVMQzdIaHlFcHE2U05wTlpMN2NtRTNzNGtxc0xVK2hJMExjZWRQY1FicUJkZytnbXFqTW5QclptSjF
2024-01-15 23:16:32 UTC	890	IN	Data Raw: 54 47 52 51 54 44 52 6a 55 32 6b 34 65 6b 4a 34 4f 45 74 75 5a 33 64 30 64 44 64 73 4d 6c 4a 52 57 46 46 34 5a 30 31 77 5a 33 56 77 55 43 39 56 56 7a 6b 30 5a 48 42 35 64 47 77 72 57 6c 49 72 4e 33 4e 4c 54 45 5a 4c 4f 55 4a 55 56 45 56 78 63 31 64 53 4b 30 73 7a 4d 6e 42 46 4f 58 49 77 4e 6a 64 74 63 58 70 71 63 7a 4a 30 62 30 4e 4c 64 53 39 72 4f 47 70 6b 4d 6b 77 33 63 6d 52 73 62 6e 42 35 52 58 64 4e 4e 6c 45 72 64 6d 63 76 65 58 5a 58 62 33 4e 4b 4e 48 64 42 4b 32 31 49 4f 56 56 4a 65 46 4a 70 65 6d 35 68 56 33 42 5a 51 55 68 51 5a 54 56 31 52 56 70 48 59 7a 45 30 52 55 78 61 64 54 64 6c 56 56 6c 61 61 32 5a 6c 64 58 6c 32 56 6b 51 78 4e 55 64 6a 64 58 41 78 57 53 74 77 55 6c 64 4b 56 57 35 56 55 6d 35 30 4e 32 4e 4a 51 6d 74 6c 57 54 56 52 65 6c 70 Data Ascii: TGRQTDRjU2k4ekJ4OEtuZ3d0dDdsMlJRWFF4Z01wZ3VwUC9VVzk0ZHB5dGwrWlIrN3NLTEZLOUJUVEVxc1dSK0szMnBFOXIwNjdtcXpqczJ0b0NLdS9rOGpkMkw3cmRsbnB5RXdNNlErdmcveXZXb3NKNHdBK21IOVVJeFJpem5hV3BZQUhQZTV1RVpHYzE0RUxadTdlVVlaa2ZldXl2VkQxNUdjdXAxWStwUldKVW5VUm50N2NJQmtlWTVRelp
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 31 36 36 66 0d 0a 65 6e 4a 79 51 56 42 4d 59 56 6f 32 64 32 45 7a 4e 6c 42 71 63 6b 74 72 5a 48 42 55 4e 6c 56 47 55 7a 68 52 63 33 4a 78 4d 55 34 31 5a 44 4a 68 53 32 63 30 56 47 51 31 4d 43 73 72 65 44 4e 76 56 46 4e 32 64 55 4a 50 5a 45 5a 73 52 33 64 5a 57 47 55 79 52 56 64 32 53 6b 52 55 5a 46 5a 4d 55 6c 56 50 4e 46 4a 4b 52 6b 77 34 55 30 4e 36 57 45 5a 7a 57 46 56 72 56 55 46 6b 56 6d 39 5a 52 46 46 42 56 57 6c 79 59 56 4e 75 4e 6d 46 6a 51 6d 64 32 62 58 68 70 52 56 64 30 4d 6d 74 6d 4d 6d 64 72 65 45 4e 32 4d 46 4a 47 62 6c 56 43 4c 31 68 5a 4d 55 4a 44 61 6a 52 59 54 32 64 5a 52 6d 38 33 59 6a 56 58 64 6e 56 53 62 30 68 4a 4d 58 68 71 56 6b 64 44 65 6d 64 72 55 32 39 57 51 58 70 30 56 45 78 51 64 44 45 78 65 43 39 4c 55 55 31 4b 54 6e 4e 34 56 Data Ascii: 166fenJyQVBMYVo2d2EzNlBqcktrZHBUNlVGUzhRc3JxMU41ZDJhS2c0VGQ1MCsreDNvVFN2dUJPZEZsR3dZWGUyRVd2SkRUZFZMUlVPNFJKRkw4U0N6WEZzWFVrVUFkVm9ZRFFBVWlyYVNuNmFjQmd2bXhpRVd0MmtmMmdreEN2MFJGblVCL1hZMUJDajRYT2dZRm83YjVXdnVSb0hJMXhqVkdDemdrU29WQXp0VExQdDExeC9LUU1KTnN4V
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 64 53 4d 31 67 30 62 69 73 35 54 55 5a 75 5a 55 5a 33 59 32 6c 73 57 46 6c 6b 57 6e 6c 56 64 6b 4e 47 61 48 42 47 4d 46 4e 49 54 32 39 6d 55 6c 6b 76 56 57 45 33 56 30 46 35 55 44 46 72 57 6d 78 6f 52 6c 70 70 54 6c 56 6e 4d 7a 68 36 65 45 68 58 56 57 35 7a 63 6e 46 32 63 6b 78 68 54 33 56 55 4b 33 64 47 59 6a 41 7a 65 6d 35 4c 51 33 68 54 52 6c 4e 70 53 46 42 48 4e 31 6c 35 4d 48 56 42 4e 47 68 6d 61 6d 74 59 56 44 49 31 51 55 4a 44 64 54 49 34 52 57 49 77 65 46 6c 61 63 55 6f 79 4e 7a 64 78 52 55 5a 4b 51 6e 6c 33 4e 57 4a 52 51 30 70 79 52 6c 56 59 63 47 45 30 61 6b 63 77 4d 45 56 59 65 6c 5a 7a 64 55 45 35 5a 48 70 56 61 54 46 31 61 33 64 6d 55 44 46 32 53 46 56 74 55 43 74 4f 51 31 59 32 65 6a 52 44 5a 7a 4e 35 54 6b 35 4f 63 30 78 72 55 47 68 74 64 Data Ascii: dSM1g0bis5TUZuZUZ3Y2lsWFlkWnlVdkNGaHBGMFNIT29mUlkvVWE3V0F5UDFrWmxoRlppTlVnMzh6eEhXVW5zcnF2ckxhT3VUK3dGYjAzem5LQ3hTRlNpSFBHN1l5MHVBNGhmamtYVDI1QUJDdTI4RWIweFlacUoyNzdxRUZKQnl3NWJRQ0pyRlVYcGE0akcwMEVYelZzdUE5ZHpVaTF1a3dmUDF2SFVtUCtOQ1Y2ejRDZzN5Tk5Oc0xrUGhtd
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 70 42 52 6c 46 42 5a 45 5a 58 4d 48 6c 6d 54 6d 6b 32 51 55 46 78 56 57 4a 42 57 48 64 6c 5a 48 46 33 56 46 67 34 53 6a 59 79 4d 6e 4e 4b 4d 6e 4a 31 57 56 42 69 57 6a 41 79 4f 56 6c 42 51 6a 5a 4d 57 55 39 77 4f 44 4d 35 61 56 41 30 65 43 39 78 4b 33 4e 69 5a 48 64 58 64 57 68 6f 63 44 56 4b 4c 30 31 4a 64 44 64 57 63 32 70 57 65 45 4e 6d 55 6c 59 78 56 56 4a 78 65 55 56 73 62 44 5a 46 4e 6e 52 36 53 57 68 6c 59 32 30 30 63 33 5a 6c 53 45 52 31 55 57 55 7a 59 32 64 6e 56 7a 4a 55 54 47 31 59 57 47 52 6e 4d 33 6c 6b 4f 47 6c 78 61 6e 70 48 54 57 39 47 64 30 39 47 56 6e 56 69 65 6e 56 73 54 58 4a 54 62 56 42 4d 4b 7a 51 33 5a 31 5a 61 4d 79 39 75 54 46 6f 35 63 53 39 30 61 46 46 57 52 44 68 54 61 57 35 5a 64 48 70 6e 54 6a 59 33 4c 33 68 72 64 44 4a 77 64 Data Ascii: pBRlFBZEZXMHlmTmk2QUFxVWJBWHdlZHF3VFg4SjYyMnNKMnJ1WVBiWjAyOVlBQjZMWU9wODM5aVA0eC9xK3NiZHdXdWhocDVKL01JdDdWc2pWeENmUlYxVVJxeUVsbDZFNnR6SWhlY200c3ZlSER1UWUzY2dnVzJUTG1YWGRnM3lkOGlxanpHTW9Gd09GVnVienVsTXJTbVBMKzQ3Z1ZaMy9uTFo5cS90aFFWRDhTaW5ZdHpnTjY3L3hrdDJwd
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 64 73 61 54 4e 43 51 58 67 76 52 7a 4a 70 52 6a 4e 34 54 44 63 7a 52 47 6c 61 4d 57 35 7a 65 45 52 45 63 58 56 75 51 6c 70 61 55 6b 46 79 4c 30 64 5a 61 6a 4a 70 4c 30 46 75 53 6d 39 6f 4e 6a 56 57 56 47 4a 52 59 55 64 6f 4d 57 5a 54 61 45 45 34 62 47 74 72 52 44 4a 55 4e 54 46 52 55 45 6c 46 54 54 52 70 4f 57 74 76 4b 32 31 6f 55 30 6c 44 55 7a 5a 53 53 33 52 6a 63 46 6c 4d 63 6c 52 53 59 55 70 74 52 6c 64 75 64 32 6b 33 4f 55 35 36 56 55 52 56 56 53 38 34 57 45 63 34 5a 48 46 52 5a 48 59 7a 5a 56 68 72 4b 31 5a 32 4e 30 56 7a 52 56 51 33 4f 56 45 35 64 32 4e 34 59 31 56 6c 51 31 55 7a 52 6e 52 50 55 54 68 47 61 55 46 69 4e 30 56 4c 64 32 70 78 51 32 6c 4d 52 7a 56 6e 63 6b 74 5a 63 30 4e 52 51 6c 64 33 4b 7a 64 61 4f 58 67 31 4e 47 31 4b 63 44 49 32 52 Data Ascii: dsaTNCQXgvRzJpRjN4TDczRGlaMW5zeEREcXVuQlpaUkFyL0dZajJpL0FuSm9oNjVWVGJRYUdoMWZTaEE4bGtrRDJUNTFRUElFTTRpOWtvK21oU0lDUzZSS3RjcFlMclRSYUptRldud2k3OU56VURVVS84WEc4ZHFRZHYzZVhrK1Z2N0VzRVQ3OVE5d2N4Y1VlQ1UzRnRPUThGaUFiN0VLd2pxQ2lMRzVncktZc0NRQld3KzdaOXg1NG1KcDI2R
2024-01-15 23:16:32 UTC	743	IN	Data Raw: 46 4d 5a 45 68 49 51 56 46 50 64 6d 31 75 61 6a 63 72 53 48 4e 43 55 47 68 6d 54 45 46 70 55 32 4a 4f 65 69 73 77 51 58 41 34 65 57 31 32 56 44 4a 54 63 56 46 70 52 6c 6c 76 62 45 68 72 4d 6b 49 76 65 46 49 7a 59 6e 4a 4f 65 48 51 7a 4b 31 70 6c 52 32 52 31 56 6e 63 34 55 48 6c 6f 51 32 4a 70 65 55 63 35 55 55 31 6c 55 45 56 58 55 46 5a 76 64 32 31 74 61 55 51 32 4e 6d 4d 78 65 46 46 55 54 56 49 31 61 46 70 55 64 6c 5a 35 4e 47 35 6b 52 53 74 4a 63 30 6c 77 4e 6b 39 51 65 45 6c 46 56 6b 49 30 54 7a 6c 61 4d 57 68 72 57 55 77 76 54 6c 6f 32 65 44 68 7a 54 55 67 31 62 55 74 43 61 46 52 6e 63 30 5a 49 59 31 4a 72 4e 33 51 76 54 30 35 36 51 6d 39 61 4d 47 70 70 4f 45 46 57 56 6a 42 78 65 44 63 77 55 46 41 32 54 45 5a 30 4e 47 31 33 51 58 52 4f 5a 45 6c 52 63 Data Ascii: FMZEhIQVFPdm1uajcrSHNCUGhmTEFpU2JOeiswQXA4eW12VDJTcVFpRllvbEhrMkIveFIzYnJOeHQzK1plR2R1Vnc4UHloQ2JpeUc5UU1lUEVXUFZvd21taUQ2NmMxeFFUTVI1aFpUdlZ5NG5kRStJc0lwNk9QeElFVkI0TzlaMWhrWUwvTlo2eDhzTUg1bUtCaFRnc0ZIY1JrN3QvT056Qm9aMGppOEFWVjBxeDcwUFA2TEZ0NG13QXROZElRc
2024-01-15 23:16:32 UTC	1252	IN	Data Raw: 31 32 30 66 0d 0a 47 56 46 64 61 56 45 70 77 61 54 4e 43 57 57 67 77 55 6b 31 36 55 30 78 54 61 6d 46 57 59 6e 70 6b 65 56 46 6c 56 47 74 50 55 6a 42 46 4e 47 73 76 59 57 4e 4f 61 54 4e 72 55 57 46 76 61 55 6c 52 54 30 46 56 59 31 49 76 53 57 34 72 63 54 51 35 51 58 52 70 63 56 41 77 55 6e 70 34 64 55 78 77 54 46 51 78 62 54 4e 4a 5a 6b 31 72 56 56 46 6a 55 48 55 35 52 6b 68 42 52 47 39 57 62 31 56 4a 65 6b 35 34 62 30 74 70 61 57 35 6d 5a 33 68 52 57 44 5a 78 54 58 6c 51 4d 48 46 58 54 6d 38 77 59 69 74 4a 55 45 4e 6f 4f 54 6c 43 62 56 46 61 65 6b 35 58 5a 45 70 43 53 57 52 33 61 6c 56 73 55 6e 52 36 65 57 64 59 4e 32 6c 78 4b 33 49 78 63 6c 46 6b 52 56 42 73 63 43 39 61 61 32 4e 4a 61 57 4e 75 62 54 6c 54 62 57 56 69 4d 46 6c 59 64 46 4d 78 52 30 5a 44 Data Ascii: 120fGVFdaVEpwaTNCWWgwUk16U0xTamFWYnpkeVFlVGtPUjBFNGsvYWNOaTNrUWFvaUlRT0FVY1IvSW4rcTQ5QXRpcVAwUnp4dUxwTFQxbTNJZk1rVVFjUHU5RkhBRG9Wb1VJek54b0tpaW5mZ3hRWDZxTXlQMHFXTm8wYitJUENoOTlCbVFaek5XZEpCSWR3alVsUnR6eWdYN2lxK3IxclFkRVBscC9aa2NJaWNubTlTbWViMFlYdFMxR0ZD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.5	50068	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	789	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_CuotYPDS-qIM0Dpn3-nunz2ADvg-BkDRuQhg8D0lO2POh8on&random=988163100 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.5	50078	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:32 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9bdea3a7e9d2018b&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpfEejYnl3-7B2GSVwDOZ_lrH2B8o9n3Gz x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: OTgzLHqcNxfaZ4xNJKhyFCzTTyFH7N3FYaUwoH8Pjt9Wy6DZ_mCnfw==
2024-01-15 23:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.5	50082	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	3243	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|2&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000
2024-01-15 23:16:32 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:32 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=863ea3a84b2002d6&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejK9nSbFhKa4wy0hWPLnDyfjY5tqiNYbqTo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: VVsoABmkgNPeWleI3DDbe8RaOyCsYWkLH_W25a9S3VnVXh_ZPnCMEQ==
2024-01-15 23:16:32 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.5	50079	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2738	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:32 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:31 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bb26a3a72b11027a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGem7VmSqKCd3dHLA-csfdrYuPRq3soM9XA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 8--lJr0vxgYDtHMtDLlz1AlpkDfnUGCe_eLpCKiIqWYtoEcmsEhBJA==
2024-01-15 23:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.5	50085	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	745	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1705360586991&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
2024-01-15 23:16:32 UTC	623	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 41 referrer-policy: origin x-pinterest-rid: 1485956581867182 Date: Mon, 15 Jan 2024 23:16:32 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:32 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.5	50080	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1512	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360583869&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Ap_SPNf2SGelSq6yDZ5n29CFuxtgwUjlZgmKE0Vrz-dfIUb2&random=3730487843&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.5	50081	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1071	OUT	GET /pagead/1p-user-list/973712236/?random=1705360583943&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJkdp08dF56vb2yMr78z82SLuNqXlT16Sb9kMIyTl32QInD1&random=152987097&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.5	50083	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	784	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360586999&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
2024-01-15 23:16:32 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 1374654437796728 Date: Mon, 15 Jan 2024 23:16:32 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:32 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.5	50086	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1701	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360587815&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
2024-01-15 23:16:32 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:32 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="; Expires=Tue, 14 Jan 2025 23:16:32 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1501090279338071 Date: Mon, 15 Jan 2024 23:16:32 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:32 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.5	50089	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1246	OUT	GET /ddm/fls/z/dc_pre=CO27uJ_D4IMDFXHNKAUdbFUMAA;src=4228414;type=views;cat=views;ord=9772720431374;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=431575551;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.5	50084	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1399	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360587004 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZZaEVVV2E2dmdEdjFMVXB5NWRldWtVbDlpbUM4dStENlFxVFlpRjdnQkNXa1QySWVuNXg5R21Kb1loeS8wQjVpNWdQZ3lHeEJNdTNoV3BWdHdLejhQYytLSGpBYytlbEdNZ2x5bTRjUXFrVT0mQysyQzdmL3I3WFJ5RVQ1Uy9zQVlza2lCdnowPQ=="
2024-01-15 23:16:32 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:32 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 2377083563697326 Date: Mon, 15 Jan 2024 23:16:32 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:32 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.5	50091	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1396	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20728&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=b4835f3e-f59e-4a99-a3c2-6f7565a3736a&ts=1705360586267&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:32 UTC	526	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:32 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.5	50088	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1072	OUT	GET /pagead/1p-user-list/975716499/?random=1705360584036&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_JxYHjTeaGMCein85ILwo78MPCfdpKTootOlECM7PTT9XNEQu&random=2596020956&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.5	50090	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1401	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=05de9b34-ea14-4ed5-9286-ad7aa95ac517&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=10745&m_fcps=9482&m_pi=10719&m_pl=16180&m_pv=2&m_rd=20730&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=64c0dc5d-700a-4844-a35b-ecd5b1805a50&ts=1705360586269&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:32 UTC	526	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:32 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.5	50093	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	2044	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000
2024-01-15 23:16:32 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:32 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6129f7f4feb0c02da809b6ee7e340b18.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: rDdFxkldETfvJVkXVNCssk15zhxBoGRMHMb4yLjT8gJNSEVbfiPWNw==
2024-01-15 23:16:32 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.5	50087	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:31 UTC	1072	OUT	GET /pagead/1p-user-list/973712236/?random=1705360584011&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_QJJA0B8mwh_FiA7A2bDQpEqb-Y1IxSI-ZbbS-fjpIZYKQy3W&random=1176934799&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.5	50094	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:32 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:32 GMT X-Cache: Error from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: aLJ5KLahoyGNn47uf15GbmLMpqz5A3hkQIW77iw0NOBQY4PXztqdGg==
2024-01-15 23:16:32 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.5	50095	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	2647	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAoDeiF8s8AAAA:smzhFY7dQGGubUAAokC+sClWlHB49PLWQuCT4PiZyeQkrNwPck4VVNTsnzTEARZ6NZ9npBR8xrJYh99b/Jy0kICTPKwI+72XTjrSkKVFrc+DnrbxBXNLumKI+6ZjN0IuheUSYLonT4vezqLRn7IAHJD7SQ6m1glf65g/6L5TXqaBQgc5l7W4iwQyyoMj6p+JPve+kovrjpCKoaMsEr1YlDSwJSxfMpBLTsyQsR/VpaGU+WP9hVhqoyTpbMTlKCX2JRg1m7Dk; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmra5pLZX0sVz1Z9htN0BLyIJmeqQg%2BoZpdhAMdtuyxLS1NsxUcdM58ynb2S1fofxjA3X3kflCrKHyxM8V8geZMT%2FwPpbf68O13tH6ea388qb1%2B7mT8weLdEi%2F5SJ1bOG7qQmmQqScb2cDBWbKFiUcZz1CynjUuQQU%3D
2024-01-15 23:16:32 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:32 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bf32a3a80c7500a5&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvXs-ysgo8PxEL98q8OtXUrfnVXfVSl3kk x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: TaetKRG_0qNl3YTHBfgSzcBr-BhRkxRJPnZkExDP_IeVYru2FLnC_w==
2024-01-15 23:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.5	50099	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:32 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:32 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d235a3a866f60207&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpw-QzelywM5isPS2zfJLwaV3jnpa9hhZm x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 4zZ1ZYgTmpjeeNQpFnic1cWTtQapkU3JUeqh2G3VyJc72rH3h6wowA==
2024-01-15 23:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.5	50100	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	2763	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000
2024-01-15 23:16:32 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:32 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d6a6a3a8644a06dd&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfmFgNK8s3f90qn9SjXCc8eEs8NnhPxwRw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: JM5rgEhYiASo5QJ0_cxrjGP-tSLyudQRB0nW2vaPGU6xB5RfKzU_Aw==
2024-01-15 23:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.5	50096	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	1800	OUT	GET /pagead/1p-conversion/988382855/?random=1896508193&cv=11&fst=1705360583361&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&auid=460620828.1705360583&fledge=1&capi=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=IgEBQAFKLG5vdC1uYXZpZ2F0aW9uLXNvdXJjZSwgdHJpZ2dlciwgZXZlbnQtc291cmNlYgQKAgID&pscrd=CLy6ksTI79ybURJOQ2hFSWdNeVRyUVlRNkp1ODNzcVQ1ZmVVQVJJbEFOdWlqNVE2emQ0QURjZ1J4Ql9POVFqNFVUQ2tOekhPMlgwdTV5UzlieXgtcGdKRkJ3GldDaEFJZ015VHJRWVE1dFgtazZ2YjJNa3NFaTBBM2FYdC1QcFB1UjZ4clNlTVFkMWpfOE50ek84aU5UbG0yQ0pnY1BnaUxGLWJpbS1pdmJkQnNjajcxTmsiEwiUv7Sfw-CDAxX9HGgIHReqAWg&is_vtc=1&ocp_id=ybylZdS2LP25oPMPl9SGwAY&cid=CAQSKQAvHhf_6MyPeivjXG9NQFiUHvFpiH-bdHK0pXPJOVzHVDhkBUZ_CIUy&eitems=ChEIgMyTrQYQu6ijp5nvhofWARIdAGk2nyjkNN3DKD3Ik-v9lvBOTd6pcmKXvc6N2K4&random=3129231315 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.5	50097	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	1072	OUT	GET /pagead/1p-user-list/975716499/?random=1705360584157&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_vL5iYH-X3Lfm-v4DQtUD5Qk1hGiiEYHtlL5rF7kIligLe8It&random=3186995343&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:32 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.5	50103	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:33 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Mon, 15 Jan 2024 23:16:33 GMT Expires: Mon, 15 Jan 2024 23:16:33 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:33 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-01-15 23:16:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.5	50105	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	2729	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:33 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1019a3a8644201ef&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstD3mZWGMVNkB0rdZiz9LWlNlN1z2m0wIw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: RS3Z3WkgwGuKncseVT0aR9F8Zd28CCuPNcR6IkLB8zntNglsJW9Tuw==
2024-01-15 23:16:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.5	50107	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	3048	OUT	GET / HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D
2024-01-15 23:16:33 UTC	2202	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT vary: Accept-Encoding, User-Agent link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css>; rel=preload; as=style nel: {"max_age":604800,"report_to":"default"} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default","max_age":604800} set-cookie: _implmdnbl=2__1__0; path=/; expires=Wed, 16-Jan-2019 23:16:33 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Wed, 30-Mar-2078 22:33:06 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:33 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 1448f69604d5be1f9c9f0c64cfa90594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: TTMiGpEBiC-vGj2J1kDXWTvRusTl1eMxOU_wl-_wFFX-IVJDDDp_7g==
2024-01-15 23:16:33 UTC	11076	IN	Data Raw: 32 62 33 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 4a 37 66 78 68 6a 6b 4c 51 63 78 46 31 37 35 22 Data Ascii: 2b3c<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="J7fxhjkLQcxF175"
2024-01-15 23:16:34 UTC	13986	IN	Data Raw: 33 36 39 61 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 369a<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-01-15 23:16:34 UTC	10136	IN	Data Raw: 32 37 39 30 0d 0a 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 2e 72 65 70 6c 61 63 65 28 27 6e 6f 4a 53 27 2c 20 27 27 29 20 2b 20 27 20 68 61 73 4a 53 27 3b 0a 76 61 72 20 62 5f 65 78 70 65 72 69 6d 65 6e 74 73 20 3d 20 7b 7d 2c 20 57 49 44 54 48 2c 20 42 20 3d 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 3d 20 7b 0a 5f 6f 6e 66 6c 79 3a 20 5b 5d 2c 20 2f 2f 20 22 6f 6e 20 74 68 65 20 66 6c 79 22 20 66 75 6e 63 74 69 6f 6e 73 2c 20 77 69 6c 6c 20 62 65 20 65 78 65 63 75 74 65 64 20 61 73 20 73 6f 6f 6e 20 61 73 20 65 78 74 65 72 6e 61 6c 20 6a 73 20 66 69 6c 65 73 20 77 65 72 65 20 6c 6f 61 64 65 64 0a 64 65 76 54 6f 6f 6c 73 3a 20 7b 0a 74 72 61 63 6b 65 64 45 78 70 65 72 69 6d 65 6e 74 73 3a 20 5b 5d 0a 7d 2c Data Ascii: 2790nt.documentElement.className.replace('noJS', '') + ' hasJS';var b_experiments = {}, WIDTH, B = window.booking = {_onfly: [], // "on the fly" functions, will be executed as soon as external js files were loadeddevTools: {trackedExperiments: []},
2024-01-15 23:16:34 UTC	16384	IN	Data Raw: 38 39 36 61 0d 0a 5f 6c 63 22 3a 22 74 6f 20 4d 61 72 63 68 22 2c 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 6c 63 22 3a 22 74 68 65 20 4d 61 72 63 68 22 7d 2c 22 34 22 3a 7b 22 6f 6e 5f 64 61 79 5f 6d 6f 6e 74 68 22 3a 22 30 34 22 2c 22 6d 6f 6e 74 68 5f 32 22 3a 22 41 70 72 69 6c 22 2c 22 6e 61 6d 65 5f 74 6f 22 3a 22 41 70 72 69 6c 22 2c 22 67 65 6e 69 74 69 76 65 5f 6c 63 22 3a 22 41 70 72 69 6c 22 2c 22 74 6f 5f 6d 6f 6e 74 68 5f 6c 63 22 3a 22 74 6f 20 41 70 72 69 6c 22 2c 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 6c 63 22 3a 22 74 68 65 20 41 70 72 69 6c 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 5f 75 63 22 3a 22 41 70 72 69 6c 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 41 70 72 22 2c 22 6e 61 6d 65 5f 69 6e 22 3a 22 41 70 Data Ascii: 896a_lc":"to March","name_def_article_lc":"the March"},"4":{"on_day_month":"04","month_2":"April","name_to":"April","genitive_lc":"April","to_month_lc":"to April","name_def_article_lc":"the April","short_name_uc":"April","short_name":"Apr","name_in":"Ap
2024-01-15 23:16:34 UTC	16384	IN	Data Raw: 5f 77 69 73 68 6c 69 73 74 5f 72 65 6d 61 69 6e 69 6e 67 3a 20 31 2c 0a 69 73 5f 75 73 65 72 5f 63 65 6e 74 65 72 5f 62 61 72 3a 20 31 2c 0a 62 5f 73 69 74 65 5f 65 78 70 65 72 69 6d 65 6e 74 5f 75 73 65 72 5f 63 65 6e 74 65 72 5f 62 61 72 3a 20 31 2c 0a 62 5f 72 65 67 5f 75 73 65 72 5f 69 73 5f 67 65 6e 69 75 73 20 3a 20 22 22 2c 0a 70 72 6f 66 69 6c 65 5f 6d 65 6e 75 3a 20 7b 0a 62 5f 75 73 65 72 5f 61 75 74 68 5f 6c 65 76 65 6c 3a 20 30 2c 0a 62 5f 64 6f 6d 61 69 6e 5f 66 6f 72 5f 61 70 70 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 0a 62 5f 71 75 65 72 79 5f 70 61 72 61 6d 73 5f 77 69 74 68 5f 6c 61 6e 67 5f 6e 6f 5f 65 78 74 3a 20 22 3f 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 Data Ascii: _wishlist_remaining: 1,is_user_center_bar: 1,b_site_experiment_user_center_bar: 1,b_reg_user_is_genius : "",profile_menu: {b_user_auth_level: 0,b_domain_for_app: "https://www.booking.com",b_query_params_with_lang_no_ext: "?label=gen173nr-1FCAEoggI4
2024-01-15 23:16:34 UTC	2418	IN	Data Raw: 4e 50 56 54 22 3a 31 2c 22 63 43 63 43 63 43 53 59 65 4a 66 61 4e 66 50 45 53 48 62 66 4e 46 4e 56 42 55 4b 63 54 4b 65 22 3a 31 2c 22 4f 44 52 64 48 55 4e 5a 57 4f 44 44 52 59 47 50 43 4a 4b 44 4b 61 54 22 3a 31 2c 22 4e 56 46 56 63 66 54 62 64 4e 4e 53 59 48 58 54 4f 4a 44 4e 46 49 61 55 4a 64 44 42 4b 57 50 48 44 44 57 65 22 3a 31 2c 22 50 65 59 47 49 48 52 49 48 59 59 66 50 59 52 5a 52 64 63 43 63 64 56 55 55 41 44 52 56 4b 61 4d 55 5a 51 4f 51 43 58 65 52 65 22 3a 31 2c 22 48 57 41 46 59 54 62 44 4f 4c 62 65 54 53 4c 62 49 65 49 64 4b 57 42 5a 45 57 61 53 45 4f 22 3a 31 2c 22 66 65 66 53 4b 65 45 46 4b 4d 42 4b 58 49 65 49 50 51 65 4a 4f 50 52 61 5a 4f 48 62 44 4e 51 4c 4f 4c 4f 4c 4d 4f 22 3a 31 2c 22 66 54 48 53 51 46 55 55 5a 41 66 52 49 5a 54 4a Data Ascii: NPVT":1,"cCcCcCSYeJfaNfPESHbfNFNVBUKcTKe":1,"ODRdHUNZWODDRYGPCJKDKaT":1,"NVFVcfTbdNNSYHXTOJDNFIaUJdDBKWPHDDWe":1,"PeYGIHRIHYYfPYRZRdcCcdVUUADRVKaMUZQOQCXeRe":1,"HWAFYTbDOLbeTSLbIeIdKWBZEWaSEO":1,"fefSKeEFKMBKXIeIPQeJOPRaZOHbDNQLOLOLMO":1,"fTHSQFUUZAfRIZTJ
2024-01-15 23:16:34 UTC	16384	IN	Data Raw: 61 32 30 65 0d 0a 46 53 66 55 57 52 43 22 3a 31 2c 22 4f 41 5a 4f 58 5a 64 62 45 4a 4e 5a 4a 53 55 46 66 64 63 53 4c 59 4e 63 4a 43 22 3a 31 2c 22 64 4c 59 48 4d 52 46 65 52 4c 50 59 4b 44 63 64 44 64 4f 4e 4f 65 66 46 4e 65 4a 4d 42 48 4f 65 46 5a 4f 46 48 65 22 3a 31 2c 22 62 5a 57 4d 53 47 45 4e 49 62 66 64 65 44 63 4e 65 4a 58 56 57 4d 44 59 43 55 52 51 54 54 61 65 22 3a 31 2c 22 61 58 62 49 53 48 63 41 61 50 64 41 48 46 65 4d 62 46 44 61 50 4b 49 43 22 3a 31 2c 22 4e 41 52 45 46 4f 51 65 4c 50 54 56 42 4e 4c 54 4c 4a 56 46 48 54 22 3a 31 2c 22 48 57 41 46 4e 52 57 4d 50 4e 53 4d 59 5a 58 55 43 65 65 43 22 3a 31 2c 22 48 56 50 5a 64 5a 47 49 47 50 65 66 44 47 59 55 46 4b 4d 42 4b 56 4f 50 61 65 22 3a 31 2c 22 54 65 43 4f 65 4a 50 4c 53 50 4d 4b 50 45 Data Ascii: a20eFSfUWRC":1,"OAZOXZdbEJNZJSUFfdcSLYNcJC":1,"dLYHMRFeRLPYKDcdDdONOefFNeJMBHOeFZOFHe":1,"bZWMSGENIbfdeDcNeJXVWMDYCURQTTae":1,"aXbISHcAaPdAHFeMbFDaPKIC":1,"NAREFOQeLPTVBNLTLJVFHT":1,"HWAFNRWMPNSMYZXUCeeC":1,"HVPZdZGIGPefDGYUFKMBKVOPae":1,"TeCOeJPLSPMKPE
2024-01-15 23:16:34 UTC	16384	IN	Data Raw: 48 58 46 5a 50 65 5a 65 4e 53 56 4d 50 59 57 62 48 52 54 63 4f 4f 49 42 42 4f 22 3a 31 2c 22 42 4b 65 57 49 45 63 62 51 47 57 46 42 61 61 65 48 47 5a 4f 54 50 63 65 59 44 65 48 5a 54 53 4a 56 56 50 65 50 5a 57 4e 57 65 22 3a 31 2c 22 4e 56 46 41 48 50 45 41 5a 46 4f 51 52 43 53 50 62 63 65 58 50 49 52 63 41 44 55 43 57 43 44 57 4f 4f 43 22 3a 31 2c 22 61 64 55 41 56 59 43 64 46 4e 4c 47 5a 61 50 51 51 53 52 50 57 64 4f 51 52 54 4b 65 65 48 52 62 64 46 49 4b 65 22 3a 31 2c 22 4f 4f 49 42 54 42 42 4c 58 4f 51 52 54 4b 65 65 57 65 22 3a 31 2c 22 65 44 53 64 55 62 61 61 4e 52 66 58 61 49 52 64 4e 44 44 43 22 3a 31 2c 22 48 57 41 46 59 54 66 4d 57 49 64 66 59 65 59 46 50 58 66 57 65 22 3a 31 2c 22 63 43 48 4f 62 64 52 64 4a 53 59 65 4a 65 44 66 62 58 4a 42 5a Data Ascii: HXFZPeZeNSVMPYWbHRTcOOIBBO":1,"BKeWIEcbQGWFBaaeHGZOTPceYDeHZTSJVVPePZWNWe":1,"NVFAHPEAZFOQRCSPbceXPIRcADUCWCDWOOC":1,"adUAVYCdFNLGZaPQQSRPWdOQRTKeeHRbdFIKe":1,"OOIBTBBLXOQRTKeeWe":1,"eDSdUbaaNRfXaIRdNDDC":1,"HWAFYTfMWIdfYeYFPXfWe":1,"cCHObdRdJSYeJeDfbXJBZ
2024-01-15 23:16:34 UTC	8726	IN	Data Raw: 63 43 63 43 63 43 43 22 3a 31 2c 22 4f 4d 59 4e 61 58 54 61 63 4d 53 48 65 50 4c 53 49 52 53 48 54 22 3a 31 2c 22 55 45 54 54 4a 62 5a 57 4d 5a 66 50 41 4a 62 57 64 41 4c 4c 62 4a 65 4a 48 49 4e 65 43 65 51 63 4a 57 65 22 3a 31 2c 22 63 43 48 4f 62 49 50 50 51 46 46 54 61 4e 46 62 4e 58 47 44 4a 45 42 42 56 59 59 54 22 3a 31 2c 22 4e 41 46 51 43 4a 57 5a 55 66 51 4c 51 42 54 4d 64 42 63 41 45 44 61 4b 4c 49 54 52 65 22 3a 31 2c 22 49 5a 56 47 5a 65 57 52 42 66 45 44 64 65 5a 4f 48 65 59 48 65 22 3a 31 2c 22 4e 41 46 51 64 47 46 45 59 4b 63 62 4a 56 61 51 52 53 41 4c 5a 50 49 65 41 4e 49 48 66 43 63 4d 4c 61 43 22 3a 31 2c 22 4f 61 61 4b 4c 65 63 54 59 53 48 4a 41 48 54 57 54 55 5a 64 61 49 4f 48 54 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 4a 58 41 61 64 4b Data Ascii: cCcCcCC":1,"OMYNaXTacMSHePLSIRSHT":1,"UETTJbZWMZfPAJbWdALLbJeJHINeCeQcJWe":1,"cCHObIPPQFFTaNFbNXGDJEBBVYYT":1,"NAFQCJWZUfQLQBTMdBcAEDaKLITRe":1,"IZVGZeWRBfEDdeZOHeYHe":1,"NAFQdGFEYKcbJVaQRSALZPIeANIHfCcMLaC":1,"OaaKLecTYSHJAHTWTUZdaIOHT":1,"HWAFNeOYJXAadK
2024-01-15 23:16:34 UTC	16384	IN	Data Raw: 38 35 64 65 0d 0a 52 4f 22 3a 31 2c 22 48 57 41 46 59 45 64 4a 62 52 59 57 4c 62 51 56 41 48 41 62 57 54 4b 65 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 46 57 55 4a 4e 56 50 4e 53 58 4b 46 4b 65 22 3a 31 2c 22 48 43 5a 41 4e 48 44 64 4c 59 42 4e 5a 66 41 41 45 41 51 4d 59 61 4e 56 53 44 63 52 5a 54 45 55 50 48 64 47 57 65 22 3a 31 2c 22 4f 4f 49 42 54 42 42 4c 58 4f 4c 44 45 5a 52 64 5a 62 56 65 55 50 58 4b 45 43 48 54 65 59 54 22 3a 31 2c 22 4e 41 46 4c 65 4f 65 4a 4f 4d 4f 4c 4a 4b 46 51 4d 62 5a 66 57 51 49 58 65 22 3a 31 2c 22 63 43 63 43 63 43 44 50 43 44 43 63 42 55 48 42 5a 4e 58 4d 52 55 4d 56 4d 49 54 41 46 66 4b 44 58 4e 4b 65 22 3a 31 2c 22 54 66 4e 5a 65 46 4f 42 45 55 63 4b 42 53 4d 52 42 47 4b 54 4a 56 4a 54 66 4e 5a 42 52 65 22 3a 31 2c 22 48 Data Ascii: 85deRO":1,"HWAFYEdJbRYWLbQVAHAbWTKe":1,"HWAFNeOYFWUJNVPNSXKFKe":1,"HCZANHDdLYBNZfAAEAQMYaNVSDcRZTEUPHdGWe":1,"OOIBTBBLXOLDEZRdZbVeUPXKECHTeYT":1,"NAFLeOeJOMOLJKFQMbZfWQIXe":1,"cCcCcCDPCDCcBUHBZNXMRUMVMITAFfKDXNKe":1,"TfNZeFOBEUcKBSMRBGKTJVJTfNZBRe":1,"H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.5	50106	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:32 UTC	5395	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|9482,js_web_vitals_fid_ms\|3&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: +PSlZQAAAAA=3dcJl-hNPexHylvAsaeVHtHcnWSML9juNFtMFqnlKY2OYMP8TW_IDQB3ivBnY0mwIrVzQ7G67TxQg-cvnD8HG0ermmliia7cFlx_9A1QVUch7nWpge0U0EiTRn6CxD1_8KVyVSb1Mo4_3oueCG5nIYyVYJbh7k60m1y8KPx5RUE-K70MLcvn0b4wpg7xXZl3wIeEySjmpIjfsTKx sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d7cca39c07340212 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438
2024-01-15 23:16:33 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4afca3a8559400db&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLuyVjsWc1hoW37hCKxsY5xp73YrunIaOs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: OwINHfEYImXeaazAm1huWovTsV15fJUUjYsMXNWCPm4YK6dPkYbHOg==
2024-01-15 23:16:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.5	50108	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	651	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 110 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:33 UTC	110	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 64 37 63 63 61 33 39 63 30 37 33 34 30 32 31 32 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 39 34 38 32 2e 36 30 30 30 30 30 30 30 30 30 30 36 2c 22 66 69 64 22 3a 33 2e 37 39 39 39 39 39 39 39 39 39 38 38 33 35 38 35 7d Data Ascii: {"pid":"d7cca39c07340212","refAction":"index","siteType":"1","lcp":9482.600000000006,"fid":3.7999999999883585}
2024-01-15 23:16:33 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e4938fc434947f57a79af6b9b403df6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: sJ608wR6VyQkibzn3F9SiDO57maTDJSfENlOyI6xK0MNlmsab5JihA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.5	50109	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 950 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:33 UTC	950	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 32 36 62 36 37 34 30 64 2d 65 62 31 66 2d 34 36 65 62 2d 38 34 32 31 2d 61 63 62 31 31 63 38 32 30 36 30 31 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"26b6740d-eb1f-46eb-8421-acb11c820601","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:16:33 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:33 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.5	50110	13.32.151.4	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	2318	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 2415 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592428
2024-01-15 23:16:33 UTC	2415	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 38 32 33 33 31 2d 34 37 34 35 34 38 33 35 30 36 39 31 35 22 2c 22 76 61 6c 75 65 22 3a 33 30 37 36 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 38 32 33 33 32 2d 34 30 39 38 35 34 32 34 32 30 36 37 36 22 2c 22 76 61 6c 75 65 22 3a 39 34 38 32 2e 36 30 30 30 30 30 30 30 30 30 30 36 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 38 32 34 38 33 2d 32 34 39 36 34 39 32 38 33 33 35 39 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1705360582331-4745483506915","value":3076,"navigationType":"navigate"},"fcp":{"id":"v3-1705360582332-4098542420676","value":9482.600000000006,"navigationType":"navigate"},"cls":{"id":"v3-1705360582483-249649283359
2024-01-15 23:16:33 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:33 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 28f481302befff8459645b5750f67a86.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C2 X-Amz-Cf-Id: vvj5nQtVjNgntD32xocsA9yDQkFZXNRZdsN-oE1W1MtHNOdkYiEB4w==
2024-01-15 23:16:33 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.5	50111	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:33 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f405a3a8aec200fd&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpdEhjcZat-2Y2Qx0xYpdu-U7NaLsaUffe x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: zJFGB56g4l-8R2R_y39xXsmErwlGWdToCJ8kmJEf73uhBHlTJXwpMg==
2024-01-15 23:16:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.5	50112	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	2064	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438
2024-01-15 23:16:33 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:33 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 19a26748942db0d3fcb162b26019f692.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: 08gNLhDaXX_mthgtzv4f0VKbZ6RcNRmGniEmUzWdkG4vQQY1ET4V_w==
2024-01-15 23:16:33 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.5	50104	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	3282	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&pid=d7cca39c07340212&stype=1&aid=304142&lang=en-us&ref_action=index&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|9482,js_web_vitals_fid_ms\|3&m=UmFuZG9tSVYkc2RlIyh9YXcWqcDGLHFsSnmWd0s9T7CtLyXC2dexpelNeI-_6dAS-horppVyL_gE3wtC_LOcskVyJb1V5EIJFjHfi8SOH590aOUEgrTzsUI6Nb7wxOPVHnlaEF9f44Nuz-CizusZjfwRqhv1NSjAHYcex5pIO7xPttqcaD6jgiJweoP8WBFmwxnHdy7A8KcgphVyPu7iMUpH_uNVuxywWlpwRl-ZAqEXubL32FFeKDHdhw0zf438ya6baSTIJ4MHDO9CcWFIf0SPmpp9PJFuuVdGMVxXlbfPEqbZV_lR9cAK_aq5T1c- HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438
2024-01-15 23:16:34 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:34 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f9f8a3a87b4a017c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLjgG9sLY7ELj3HMVPuFmzWdqCDDvgmLYo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Z6OKXOZb8_ZSt_yY_4vVG0pXuhPegRPdnWCL0PbvM5cr5EFhzJmtTQ==
2024-01-15 23:16:34 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.5	50113	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:33 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:34 UTC	370	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:34 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d3c109ec8015-IAD
2024-01-15 23:16:34 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.5	50114	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:34 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:34 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7b3da3a9476000d8&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpXbqLZpaW7Q53jeo0FMru-cuu-0PeT7I0 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: IwziQOn7xl9m8e4Pw6pda21Uxhn7hXzSRxu38XF6LbDxHW85YrRL5Q==
2024-01-15 23:16:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.5	50115	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:34 UTC	249	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:34 GMT Content-Type: text/javascript Content-Length: 92 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d3c40f5b05d6-IAD
2024-01-15 23:16:34 UTC	92	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.5	50116	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	668	OUT	GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "65adf2d4363bba13d63bbc403b0b3cce" If-Modified-Since: Mon, 15 Jan 2024 13:45:30 GMT
2024-01-15 23:16:34 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT ETag: "65adf2d4363bba13d63bbc403b0b3cce" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: u3cn6Ed7thVPXGQQa79hHShJJmXcB4zJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: p9CDTSFq3v6WzBJDQouv5xYdqryoSnXMqmnI1pwGDpXb-sVhWj6xLw== Age: 34264 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.5	50117	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
2024-01-15 23:16:34 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Ukxg3naZ6RIMZfHmzISeYJ28SV5gPagG Server: AmazonS3 ETag: "2980ea90c3f4c27d77bffbd1527870a7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 749e1450fdc7cac18bb91a34e80053aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: bY7aRVrSDBBEMSBp9Q7G_Lp7MmM25Q4xcGmLoCvn7GRvJMtrA7ezYw== Age: 79042 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.5	50118	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:34 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1FYxBAlnpir4aMeZTk4ZcxEZA4fQWxaq Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 749e1450fdc7cac18bb91a34e80053aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9xrXvaaVU2lkth0neRm8CTyjCHuQm44kxkU6ZWRdKJNzvQimhJrByA== Age: 68227 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.5	50119	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:34 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HFw3ZCRRGpO5Si5sk_Tu_yxdqq5JBka Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WPcbyUDyJcMi6mOS2AfrrCnSPwvgjCjhmrEn6tluAfalGj-WR7U_Qg== Age: 68227 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.5	50120	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "4066f4e0b6c463342177866cfb14bcfe" If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
2024-01-15 23:16:34 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnArrg..MyhLONitGPttToVO8CuhdWrQ Server: AmazonS3 ETag: "4066f4e0b6c463342177866cfb14bcfe" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NtztKoP-HEFCcSVBZXYDFn2INep9MfYxKycboYN23-LG7M895XM9yA== Age: 68227 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.5	50121	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
2024-01-15 23:16:34 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:34 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XfMuq.rXaESBqMTX7ruwS5oLJVLV6ApO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 67711c5cba0352ee130f60f6cc103e0a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: bl7cxaGDd3myA10_3iPwP7HPTgNXfs3N3Tc_WwjmBvqvYVIZcZRpXw== Age: 55156 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.5	50122	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	2725	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A19+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; FPLC=CSIqH1kbnURkn4s2i5y8zk1Gr%2Bogkkvf%2BWMQNYYecaU1Yz4Vqg9gEsIDOCyCt8V5kklhy2dkBCH8TXpmJNKmPuc4hvSoC4wb2UPXkjAUbyGJzX60OAf1Bw0II6gtBg%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZmIPu2FPRiEbOmLzLcIyXEjYcpZ%2Fi81PYB5VCH1XVcbmGe7ekgE5zFeqFAz%2BeDt6VNdyw8fmMneyd0cewc0XbmAf9begT3TQwPwj4WzhPUbLPMMqMRnA1qnw5lEDtoc1pRPVMBQWMHFI7cNAPXWEcuc%3D; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb
2024-01-15 23:16:34 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:34 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5c79a3a9079f00a4&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpQQBlJUapnMl53CxGRvxZjFqa3X-9mA9r x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: apZTvpq7JaLkIhl1rStWBwMfXn96-8YnsnwYzS3nl41s7kxZvQ3hdg==
2024-01-15 23:16:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.5	50123	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	676	OUT	GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1fe97ff079513bb667876c67c4aa952f" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:35 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "1fe97ff079513bb667876c67c4aa952f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: fCN4NuuMwamSymkc1hBoNY2dedXX15Np Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 dc81af6f14945ade0fd126a735f82ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: KvX4HGw60WreDIBeHZpfXJEM9-rQBshiMa-7FISNfuEX5aeg1UWiAw== Age: 68228 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.5	50124	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	682	OUT	GET /psb/capla/static/js/client.923775ce.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "a4618794d329c0c74897c7e2128aa1cc" If-Modified-Since: Mon, 15 Jan 2024 08:33:15 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "a4618794d329c0c74897c7e2128aa1cc" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: MWQ8NYyocnzMbPoiKsqG.wjNMqQ87ZuL Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: jtiH687nyik01AyaDiww1mLkNY6CzLqNAixTjYIxpbJHDlFhdntBpA== Age: 52198 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.5	50125	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	690	OUT	GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "3dea702266bc3a577d7141f2e79259db" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "3dea702266bc3a577d7141f2e79259db" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XlrxmKGuatqP44w.p7biLYQQatvO241o Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec809871438c11b540493503de981368.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: V557he-XTr2pdPCHdoAGziO92DiCe8dAWL5VRYKJjyiVlyaRpH4ArQ== Age: 23211 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.5	50126	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	690	OUT	GET /psb/capla/static/js/eb60141d.11bec58c.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "ce1b060a535136eefe1c7d1a63051046" If-Modified-Since: Fri, 12 Jan 2024 13:21:43 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: FlmfvjlRoSBDOj8_2C44RDs_tZ9gr6ca Server: AmazonS3 ETag: "ce1b060a535136eefe1c7d1a63051046" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: fuvB3A7NVpta3WNZGfw2H7h6MfdY4NvJit9hrKd-a_O0xQ6wjA4e6Q== Age: 28741 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.5	50127	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	690	OUT	GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "449f8abd0585d68506a1e46ad4a8bbad" If-Modified-Since: Mon, 15 Jan 2024 20:10:57 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "449f8abd0585d68506a1e46ad4a8bbad" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HrQZAFmPje397T7kC9Z_Niv7jdtwFdr Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Vc-hf3RE8rEFDx-Z52YFU1ttGsmrp09TNKq6xcaAfKLE4DccKp9uxg== Age: 10509 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.5	50128	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:34 UTC	690	OUT	GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "eefe1bd68506ecbaf7afcee3ddccc7e4" If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: FSpeoflwTC18Opc6yNd_vAzlp6byL2KT Server: AmazonS3 ETag: "eefe1bd68506ecbaf7afcee3ddccc7e4" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: F4K_jdfVdyGaKHReys_eaunLOmCpBlAjQN2uWbAgHkQ0FNO-r8ouXQ== Age: 27363 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.5	50129	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/a6a21c13.3e4975b8.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6c724cb3ab9cbeccff5d0251367f5e7d" If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: mWj1MWDOaLp504oq_2FgZJvad26ighN4 Server: AmazonS3 ETag: "6c724cb3ab9cbeccff5d0251367f5e7d" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WjxWWlAW0hj1GsEIBOj3HN13JAxZ8iVFEYAIKA4juiNRMF_VLw3eUQ== Age: 23046 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.5	50130	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "b784a10f3e0a67de1f039c5da9307d34" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "b784a10f3e0a67de1f039c5da9307d34" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GcfhqSlQxX6laSWvPSw_OLQhf5iCGLDh Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Whh72XTBK7L79UBvSADxIvMPcHMW4ULxf2VjslcdeQG9VkArnF61WA== Age: 23901 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.5	50131	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "90af4f7d03acdf40d8242f30e2fb0a85" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "90af4f7d03acdf40d8242f30e2fb0a85" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eNb6WNMzTplU2ySq4MjrHGlImCLQ0xwr Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: qIOwq_b4axe13L18G7Xd4cTLfvEOX2GSuUPm0mB71lLwJFqAMoPm7A== Age: 23901 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.5	50132	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "a49908dd31f3e4bd429d8384882c9cd8" If-Modified-Since: Fri, 12 Jan 2024 09:30:42 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 8fHsyNxOTixWNLqS0p5QX5MbPJsCcsDz Server: AmazonS3 ETag: "a49908dd31f3e4bd429d8384882c9cd8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 924c3fd5fff04ef5cac09fbfc470e618.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: I7d4jsVkal7B4YNSSH2OhLU1bD3f8uubjWAoaAN8MfYG9VD45CMWOw== Age: 45968 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.5	50133	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8d340c5f9230be5b10b1f59d2a17b65b" If-Modified-Since: Mon, 15 Jan 2024 08:33:14 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "8d340c5f9230be5b10b1f59d2a17b65b" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Pac9I_hNFcXXJu9.GA9ZdW.xHsF0wStl Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: O2-BN0rU3kcliaUI-MMY9LaLdXm3OrSD2IZPnwPDwVsHQPsLwipMZw== Age: 52198 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.5	50134	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	690	OUT	GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e8acd113d90ead00a8a9f3cf0530ceca" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:35 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:35 GMT ETag: "e8acd113d90ead00a8a9f3cf0530ceca" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 2JfhWBDNXPlLVY4Y7uHW7GITTlaBSUhU Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: o8yEGpnMr77NbBx961SRUYgvo1G2KpaXLj9xx_iy9Vxq8LlqT7r3RA== Age: 21726 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.5	50135	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	687	OUT	GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:35 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Content-Language: 45792 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * Date: Fri, 05 Jan 2024 15:17:35 GMT Cache-Control: max-age=2592000 ETag: "d266b8ba8cd5636f0ef98de21b5ec6eaa2e51112" X-Cache: Hit from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: tzlTEOrl4Ow8CJRxfEtSoK0ZBshL5jQc7mivPZcp-AsbkJrtnrc5Kg== Age: 892740
2024-01-15 23:16:35 UTC	16384	IN	Data Raw: 62 32 65 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 f4 01 f4 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: b2e0JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:35 UTC	16384	IN	Data Raw: 0f f4 07 a5 7a 37 8a 74 f1 79 a6 da 6b 36 ac b8 2a 23 94 7b e3 83 5b 4a fc ca c7 3a 51 de 47 2a 6e 59 7b 71 ef 50 c9 78 ed c7 18 35 13 41 33 be c0 41 24 e3 19 ab 69 e1 ed 46 6e 70 ab ec cd d6 86 e5 1f 89 83 54 5e c8 75 b6 b4 f6 b2 23 84 53 b4 71 cd 67 5f 4f 1d e4 8e ec b8 2c 73 c7 6a d4 1e 14 d5 1e 32 c1 10 e3 b6 ea ce bc d1 af ac 9d 56 68 f0 c4 64 0c d1 09 ab e8 f5 14 a3 4c cf 10 40 a3 92 d9 a2 93 38 c8 c1 a2 b6 bc c8 e5 a4 7d 12 af 53 29 cd 50 47 cd 58 57 c6 39 ae 24 c9 68 b8 a6 a4 53 55 95 b3 52 ab 55 5c 4d 16 01 f6 a5 f4 c5 46 87 de 9c 0e 4d 34 c9 24 56 c1 ab 31 be 6a 98 34 e5 7c 55 26 2b 16 25 4a 80 8c 1a 90 4f c6 08 cd 35 d8 31 c8 a4 d8 02 81 b7 9a a1 ab b7 97 a5 5c 30 fe ed 5d 1d 2a a6 a8 be 66 99 3a fa a5 27 b1 4b 73 cd 27 e4 1e 7d eb 14 90 b1 c8 Data Ascii: z7tyk6#{[J:QGnY{qPx5A3A$iFnpT^u#Sqg_O,sj2VhdL@8}S)PGXW9$hSURU\MFM4$V1j4\|U&+%JO51\0]*f:'Ks'}
2024-01-15 23:16:35 UTC	13032	IN	Data Raw: ca 3e de 80 0e 99 ad 1f 14 8c cd 62 bd d6 0c 7e a6 9c 7f 80 fd 51 15 35 c6 41 76 4c c0 f9 48 39 e9 4d 31 e4 fc a2 9c 00 dd 8e b4 10 d9 f6 ae 63 bd 1d 39 5f 2b c2 17 44 70 e3 cb 01 bb f5 35 cb 7d aa e1 3a 4d 27 fd f4 6b aa bb ca f8 52 e9 73 d5 e3 fe 75 c9 ed e7 3b 85 75 e2 5b 52 49 76 47 9d 80 8a 95 39 36 b7 93 26 5d 42 e8 1f f5 cf c0 f5 ae 8b c3 3b ef a7 51 3b 96 52 71 fa 57 2f 80 3a 75 ae a3 c2 99 57 56 cf 42 69 e1 65 27 53 7e 8c 9c c6 9c 55 0b a5 d5 7e 66 33 de df 07 6c 4c 70 09 02 a2 37 b7 ac 79 b8 71 f4 35 55 dd 84 8f cf f1 1f e7 4c 32 1d d8 c1 ae 7e 79 f7 3b 95 2a 4b ec af b8 d9 d2 24 9a 5b df de 4d 23 8c 74 66 27 bd 41 ae 90 35 59 46 78 07 00 54 da 06 5a f0 83 9e 83 f9 d4 1a ca e7 57 b9 c1 fe 3c 57 44 df fb 3c 5b ee 71 52 4b eb d3 b7 f2 a3 3b df 8c Data Ascii: >b~Q5AvLH9M1c9_+Dp5}:M'kRsu;u[RIvG96&]B;Q;RqW/:uWVBie'S~U~f3lLp7yq5UL2~y;*K$[M#tf'A5YFxTZW<WD<[qRK;
2024-01-15 23:16:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.5	50137	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	4274	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:36 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:35 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ec50a3a9d63e0218&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKOTDca2UKLas-bnnAcXjUnvDh7LJFWn18 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: JcBsTz8ocEYdFqrmFGv00xLGfa-rNVXKYTMiYwVNsaZuUgWItDKg-A==
2024-01-15 23:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.5	50138	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:35 UTC	637	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-Modified-Since: Mon, 15 Jan 2024 23:16:18 +0000
2024-01-15 23:16:36 UTC	497	IN	HTTP/1.1 304 Not Modified Content-Type: text/javascript Connection: close Date: Mon, 15 Jan 2024 23:16:36 GMT cache-control: private, max-age=86400 last-modified: Mon, 15 Jan 2024 23:16:18 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd4-1b2bf57c7ea0106711edbc54 X-Cache: Miss from cloudfront Via: 1.1 749e1450fdc7cac18bb91a34e80053aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: trn9631_Sie0OZ-Az1wDlNLkceAEkLG5bEUsX10mHopU0escnf-uuA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.5	50140	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	452	OUT	GET /xdata/images/xphoto/500x500/220031205.jpeg?k=bf9841e8ba89dfdf92e02d45e45dc89fcca2d981b7c74ad57d3ecf6ba64ba1c2&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:36 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Content-Language: 45792 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * Date: Fri, 05 Jan 2024 15:17:35 GMT Cache-Control: max-age=2592000 ETag: "d266b8ba8cd5636f0ef98de21b5ec6eaa2e51112" X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: S37cTxq6lvVjf5qBZsWymdttEtKK6RZvIWsPiv1vSGTPwkBe7DOCoQ== Age: 892741
2024-01-15 23:16:36 UTC	15835	IN	Data Raw: 62 32 65 30 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 f4 01 f4 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: b2e0JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:36 UTC	16384	IN	Data Raw: e0 58 64 c9 27 f4 e9 4c 96 38 f3 81 92 3d 29 90 89 a1 56 3c e3 b8 c5 5f 8e 56 2c b2 6c 40 c9 81 92 a3 06 93 a7 67 7b 95 ed b4 d8 ca 68 60 ec 98 aa d7 36 71 2a ef f3 06 2b a7 12 41 1b 3b 30 8f d7 2c bc 55 c8 ed 21 96 c9 9c 41 1b ee f9 81 d8 3a 56 6e af 26 a6 6e aa ec 79 bb 95 5c e1 85 43 e7 ba 10 43 91 83 91 83 5e 94 0e 9d 27 32 d8 42 14 60 6d d8 33 51 c9 a6 e9 a4 87 5b 28 99 1c f4 c6 2b 45 8a 5d 62 60 dd ce 02 4d 6b 54 9d 3c 93 72 db 47 a0 ed 5c de ab 2c f3 5d 81 24 8c e5 54 63 27 35 d6 f8 f2 c0 e9 37 d1 cb 6e a6 18 24 4c 90 3b 1a e1 04 f2 4d 73 f2 36 e0 7b 9a fa 2a 7e c2 58 78 ce 94 52 b9 e0 aa 73 8d 66 a4 ee 8b 70 2e 58 46 c3 ad 3c a9 b5 2f 02 a8 20 f2 73 4e 99 24 8d 52 46 00 12 38 35 b9 a7 e8 32 6b 16 09 3b c8 96 ae 1f 0d 24 b9 f9 97 1d 85 73 d4 76 57 Data Ascii: Xd'L8=)V<_V,l@g{h`6q+A;0,U!A:Vn&ny\CC^'2B`m3Q[(+E]b`MkT<rG\,]$Tc'57n$L;Ms6{~XxRsfp.XF</ sN$RF852k;$svW
2024-01-15 23:16:36 UTC	13581	IN	Data Raw: b7 7e 6b 29 78 a3 e0 92 3b fb 57 05 69 ba f3 72 6b dd 8f 98 41 3a 70 e5 4f 59 12 c0 90 de 0d d7 88 12 6c fc a7 1d 07 61 4d b8 8c da 64 48 82 68 8f 6a 75 f5 fd ab 91 0a ae d9 88 cb 1e cb f5 ae 78 5c 49 79 1d c8 95 27 48 8a fe ed 4b 65 9f 1f c8 56 50 a7 2a 9e f3 d1 76 ff 00 23 46 e3 05 6d fb fc c6 6a 8f 04 08 b3 5a 38 8d 4b 61 d0 f7 fc ab 6f 44 f1 15 bd ab 15 99 c9 64 42 c3 3d f8 ce 2b 94 5b a8 ad 22 78 ae 5a 2b 65 91 7e 54 8d b7 3f e2 7b 1a 81 65 85 79 61 2c a0 8f e3 6d dc 57 a5 4e 6a 36 8c 8e 79 d0 95 9f 27 47 f7 9c 7d e3 ae a7 ac dd df 11 b1 26 99 a4 0a 7d 09 cd 59 69 21 95 51 e2 5c 79 3d 09 e8 58 d6 8d ee 9b 6c f0 17 82 16 8a 50 7f 87 d2 b2 92 36 85 d5 cb 16 55 e7 6b 1e 2b 77 ae a6 3b 45 2b 59 f7 2c 2a b8 07 cd 90 48 cd c9 3e 95 2c 58 f2 f1 dc 8a a6 97 Data Ascii: ~k)x;WirkA:pOYlaMdHhjux\Iy'HKeVPv#FmjZ8KaoDdB=+["xZ+e~T?{eya,mWNj6y'G}&}Yi!Q\y=XlP6Uk+w;E+Y,H>,X
2024-01-15 23:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.5	50141	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:36 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:36 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-headers: x-booking-et-serialized-state access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c59b5a542015c208c95d2ed3c65cdbcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: w9BD6Wq4xMAj-GwFEGc99OSrAcUXwOfZkRCcZaPJqz-geIi5P2Nhgw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.5	50143	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 4352 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:36 UTC	4352	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 71 39 71 69 33 2b 30 66 41 41 41 41 3a 6e 62 6b 79 65 51 47 32 53 66 2f 6b 56 32 41 39 52 46 6b 42 64 6e 33 56 4f 4d 69 72 6a 6b 70 5a 66 4e 4e 53 76 5a 58 69 72 4e 41 4a 32 4a 4a 31 36 30 56 78 49 37 6c 35 6a 39 43 59 53 43 36 6d 32 31 38 51 55 6d 68 57 74 73 2b 59 34 6e 54 4c 67 75 7a 4a 6c 49 6e 63 55 48 4d 72 77 32 4f 32 78 4a 48 79 6a 31 6f 73 62 57 67 6f 38 58 53 55 76 74 45 6b 64 68 2b 36 6e 31 62 6f 7a 30 6a 55 6c 38 64 4f 72 77 70 79 33 74 78 64 2b 4b 49 56 48 50 69 5a 56 6f 71 63 4e 6c 61 54 47 42 5a 55 36 50 77 59 74 49 55 71 49 6c 59 43 45 34 4b 73 6e 7a 76 61 32 61 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2a
2024-01-15 23:16:36 UTC	586	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1565 Connection: close Date: Mon, 15 Jan 2024 23:16:36 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd4-1fe7ad3e117d91123c2eaeee X-Cache: Miss from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Vsysavv5aViJGDjcnxmC5RaZ1_kOAIzUgcKARmx_smufyA4Nd99aiw==
2024-01-15 23:16:36 UTC	1565	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6d 6c 71 6a 6b 77 6f 44 41 41 41 41 3a 32 61 41 75 4b 6b 6a 2f 54 6b 4f 58 6d 4b 58 4b 50 55 6a 49 6b 43 53 5a 2f 68 4c 49 6b 4a 42 4c 4b 52 42 6b 68 73 39 58 6f 4b 4e 51 6c 37 72 78 4d 75 73 4d 4d 5a 45 2b 56 77 38 34 74 6b 78 53 4e 33 2f 76 2b 4c 48 58 77 55 36 42 37 71 2f 49 4c 50 71 4a 2b 66 4e 6a 69 47 47 39 6d 4c 35 54 42 45 4f 6e 35 65 76 72 37 77 33 54 49 49 51 59 32 57 78 78 41 68 65 4e 38 46 55 6f 59 53 6d 6e 56 74 48 65 69 37 30 4a 62 68 36 51 44 4a 6d 33 67 68 55 36 77 66 68 30 6d 43 6c 4a 79 4f 52 7a 68 42 34 65 76 69 69 79 7a 67 2f 48 78 52 59 73 73 73 65 34 66 52 6e 35 79 2b 46 64 74 6a 65 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+Fdtje

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.5	50142	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 949 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:36 UTC	949	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 61 31 66 33 39 30 37 39 2d 30 63 38 65 2d 34 61 35 33 2d 61 36 39 33 2d 61 66 37 36 38 63 32 61 35 32 61 31 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"a1f39079-0c8e-4a53-a693-af768c2a52a1","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:16:36 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:36 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.5	50145	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	3266	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0
2024-01-15 23:16:36 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:36 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=15fba3aa21a10272&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL6IbrOh45nlikyNfA5It9vEZkhyqnBXG0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: uEPQqmMiga2jjjBJklLIV4ZC87wZsGairHUjenlc1rtTIkklVDMPdQ==
2024-01-15 23:16:36 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.5	50147	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	4344	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0
2024-01-15 23:16:36 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:36 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7a6da3aab2c60357&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJW13rCvGSuoJh5-TVC0_OcojjQcnJh0lU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: vyOo5cF4zbB5K2CLhMcxpXzX6Y8GF8NUU1vpgilylJOO7toTH4IKZQ==
2024-01-15 23:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.5	50136	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	4007	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1538 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-AID: 304142 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0
2024-01-15 23:16:36 UTC	1538	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_title":"Booking.com \| Off
2024-01-15 23:16:37 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 91 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:36 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:36 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2f7ea3aaae2a03b2&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqss_Gq34MKgeTYunBIJp-tB8yOHzYQZrLSU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 7Sumj9mmUQijNUWuXhWh4qHhW3CoLAfOR_nQclrkNkUgHVBn7zk27w==
2024-01-15 23:16:37 UTC	91	IN	Data Raw: 5b 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"content":"Sent","status":1},{"content":"Sent","status":1},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.5	50148	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:36 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:36 GMT X-Cache: Error from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: eV1Vq6dP9DJUZlslzf_9rNrz8L81roQouuVn6ykHTQZJrS-r3UrcBQ==
2024-01-15 23:16:36 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.5	50149	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	2433	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; _ga=GA1.2.810723182.1705360577; lastSeen=0
2024-01-15 23:16:37 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com vary: Accept-Encoding access-control-allow-credentials: true referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2959f5d118b77b5c8e1e086d4a1147c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: G6Ae9ugveeGG2HmzmsEcshiaSk4PAN8OadJ8UgZjd26wmMyKi18_Ag==
2024-01-15 23:16:37 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.5	50144	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:36 UTC	3062	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605931 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAq9qi3+0fAAAA:nbkyeQG2Sf/kV2A9RFkBdn3VOMirjkpZfNNSvZXirNAJ2JJ160VxI7l5j9CYSC6m218QUmhWts+Y4nTLguzJlIncUHMrw2O2xJHyj1osbWgo8XSUvtEkdh+6n1boz0jUl8dOrwpy3txd+KIVHPiZVoqcNlaTGBZU6PwYtIUqIlYCE4Ksnzva2aryzPAoeh0/49XB1cMegAx6NPQz5lSchS8WaLuTz2T7Jq4jX3UgelEu0pbaPspLmv3sCwdya5vbT3FgEETb; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=1705360592438; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A33+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:37 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:37 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ab2ca3aa60bd0065&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzytkF4mi53LliYnIXYCWCIiwvXophCRUE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 1448f69604d5be1f9c9f0c64cfa90594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: cG-rVvEEu_kcl34hN-By-nyZLkcn8bTgyR1WGupp3x9Rs6KItlFiiA==
2024-01-15 23:16:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.5	50151	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3278	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; lastSeen=1705360596429
2024-01-15 23:16:37 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b4eda3aac14d022b&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLbGgmG8vrbO1J_a8QCvUXkjXKXlgbBeOY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: btdsh75eN39aLNea_JdUgb3ZaQtyncybbXN7u847pYfLXzSR_txKQg==
2024-01-15 23:16:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.5	50150	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 952 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:37 UTC	952	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 62 32 33 61 61 35 30 31 2d 64 35 38 62 2d 34 34 36 31 2d 62 34 66 35 2d 36 38 30 36 61 35 39 32 31 39 61 62 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"b23aa501-d58b-4461-b4f5-6806a59219ab","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:16:37 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:37 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.5	50152	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:37 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 37 63 65 63 61 33 61 38 39 63 36 64 30 30 31 65 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 32 35 33 31 2e 38 39 39 39 39 39 39 39 39 39 39 34 7d Data Ascii: {"pid":"7ceca3a89c6d001e","refAction":"index","siteType":"1","lcp":2531.899999999994}
2024-01-15 23:16:37 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 40b60aeaf88b52755048e453b78f096e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: OAHG6fLxyx0PlmKusFLHcxH6IIMYDP0R2u60EO8g8iEzh5viOk9fpQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.5	50153	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	4341	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|2531&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOssNOYCNwQ%2F0QLpgwXL4U57Nn1QBusJ59zVJlfrU54KoUB1DNC5gTo2ElTbSEnQZgxzXYxYyh12gnbMD8FFSZC9v9EGfKKXUBQg4wiuiicrEtNflUPO3KoywowvRDzy8qqcYKyp6tQP3k8N3sTsv9se8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; lastSeen=1705360596429
2024-01-15 23:16:37 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=13caa3aa14ea004e&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKFCi0Vou-OJAHd8hkWOUgIvygnY8B6U-0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: anxzTK8ipLzIcn1jUq0HH1B27tejMdyb4bkmNFyGoRIo5HYV_x5ZIQ==
2024-01-15 23:16:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.5	50154	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	2782	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; lastSeen=1705360596429; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D
2024-01-15 23:16:37 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9991a3aa4ae20145&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvgkms_pw5MCBk5ZAAn1LwFQJebYA_LD6I x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7f7e359e1c06a914d3d305785359b84c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: J90Er6uoZ7_xglQxMp7gJa7Wev_AyCgU6YKq-Qz5hHeFPQmpJKpJPQ==
2024-01-15 23:16:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.5	50155	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 1831 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:37 UTC	1831	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6d 6c 71 6a 6b 77 6f 44 41 41 41 41 3a 32 61 41 75 4b 6b 6a 2f 54 6b 4f 58 6d 4b 58 4b 50 55 6a 49 6b 43 53 5a 2f 68 4c 49 6b 4a 42 4c 4b 52 42 6b 68 73 39 58 6f 4b 4e 51 6c 37 72 78 4d 75 73 4d 4d 5a 45 2b 56 77 38 34 74 6b 78 53 4e 33 2f 76 2b 4c 48 58 77 55 36 42 37 71 2f 49 4c 50 71 4a 2b 66 4e 6a 69 47 47 39 6d 4c 35 54 42 45 4f 6e 35 65 76 72 37 77 33 54 49 49 51 59 32 57 78 78 41 68 65 4e 38 46 55 6f 59 53 6d 6e 56 74 48 65 69 37 30 4a 62 68 36 51 44 4a 6d 33 67 68 55 36 77 66 68 30 6d 43 6c 4a 79 4f 52 7a 68 42 34 65 76 69 69 79 7a 67 2f 48 78 52 59 73 73 73 65 34 66 52 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fR
2024-01-15 23:16:37 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 860 Connection: close Date: Mon, 15 Jan 2024 23:16:37 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd5-6ec6458b034d81a6773ef0e2 X-Cache: Miss from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ShdMRZbXgHubGvYL4YHnFYqJPIYLicwghXC20xcdMMly4ej45pXjEw==
2024-01-15 23:16:37 UTC	860	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6d 56 4f 6a 57 7a 45 48 41 41 41 41 3a 31 2f 51 4f 6a 66 78 70 37 38 4b 4c 54 6f 4d 48 55 55 71 43 2f 4f 35 48 6e 53 53 6b 30 51 78 51 56 56 38 78 4a 35 31 30 62 68 4d 4c 2b 69 50 4f 79 6b 52 6d 63 79 6c 58 36 7a 73 6e 45 6d 74 68 48 66 65 75 49 62 74 76 44 4c 64 49 49 37 30 64 70 33 58 33 32 7a 64 76 66 69 48 54 68 46 30 72 56 43 32 71 58 35 6c 48 45 2f 45 4c 56 71 76 46 54 76 47 7a 78 6a 50 4d 2f 55 37 30 63 36 77 79 39 69 30 4e 6e 61 78 32 5a 58 50 37 44 49 74 58 4a 77 42 43 33 30 39 68 35 4f 4f 33 68 66 64 69 63 57 41 58 4b 35 41 63 64 49 79 38 78 6f 4e 56 6c 54 69 79 79 65 72 32 79 59 34 4d 41 6f 6c Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.5	50157	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3488	OUT	POST /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&etgwv=js_onload_resource_transfer_size\|47&_=1705360596926 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=44c2a3aa629a00b8&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJBlW5r8svThZuEUCBJURN9ggkB61BDhtQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 1448f69604d5be1f9c9f0c64cfa90594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 2lbZnX7xngwBcYo0W5JV9T1X6AZnkOzqwpZmENt9qI9QPmRdRX51kw==
2024-01-15 23:16:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.5	50156	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3490	OUT	POST /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&etgwv=js_onload_resource_transfer_size%7C47&_=1705360596927 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a60ea3aae44d0094&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKzvpN5cRhEcArVSldLb0JqSlrmM2A-HRo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: yFA1YMliyxOsvWZHHWj1sLGIJK2Blzvpb2r2xPJ9pwpo0qBjeVGZ-Q==
2024-01-15 23:16:37 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.5	50159	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	402	OUT	GET /static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:37 UTC	768	IN	HTTP/1.1 200 OK Content-Type: text/xml Content-Length: 679 Connection: close Server: nginx Date: Tue, 19 Dec 2023 07:59:15 GMT Last-Modified: Wed, 10 Apr 2019 11:21:56 GMT ETag: "5cadd1d4-2a7" Expires: Thu, 18 Jan 2024 07:59:15 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: EFS-vdG5ReyBwiZ8yJlIfuz-u8yhpjmSZN-WSLu7ayrnk3vTJMURZw== Age: 2387842
2024-01-15 23:16:37 UTC	679	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 4f 70 65 6e 53 65 61 72 63 68 44 65 73 63 72 69 70 74 69 6f 6e 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 61 39 2e 63 6f 6d 2f 2d 2f 73 70 65 63 2f 6f 70 65 6e 73 65 61 72 63 68 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 6d 6f 7a 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 32 30 30 36 2f 62 72 6f 77 73 65 72 2f 73 65 61 72 63 68 2f 22 3e 0a 3c 53 68 6f 72 74 4e 61 6d 65 3e 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 3c 2f 53 68 6f 72 74 4e 61 6d 65 3e 0a 3c 44 65 73 63 72 69 70 74 69 6f 6e 3e 6f 6e 6c 69 6e 65 20 68 6f 74 65 6c 20 72 65 73 65 72 76 61 74 69 6f 6e 73 3c 2f 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 3c 49 6d Data Ascii: <?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/" xmlns:moz="http://www.mozilla.org/2006/browser/search/"><ShortName>Booking.com</ShortName><Description>online hotel reservations</Description><Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.5	50158	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	1015	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360594846 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:37 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Mon, 15 Jan 2024 23:16:37 GMT Date: Mon, 15 Jan 2024 23:16:37 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:37 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-01-15 23:16:37 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-x
2024-01-15 23:16:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.5	50162	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	2818	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053605931 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:37 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b390a3aaaf3e00ba&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzKwzrd6pLTvm5adyo7VQsZjOqxPPueH83 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: F0cHpnzxlG8oxJOGY96W-eXHPLvUfNmyW_DWYsB43pHodoLITCJ5fQ==
2024-01-15 23:16:38 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.5	50163	108.138.85.68	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	2123	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:37 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2ad6789a221bb559c9b8ce946b65a03a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: OEHkpayoawhYK2r1eiSqG6V-oOiijhcintXCR95ltXp6xb52F5_fNQ==
2024-01-15 23:16:38 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.5	50160	172.253.115.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	386	OUT	GET /.well-known/web-identity HTTP/1.1 Host: google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:37 UTC	466	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/.well-known/web-identity Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 244 X-XSS-Protection: 0 Date: Mon, 15 Jan 2024 23:08:50 GMT Expires: Mon, 15 Jan 2024 23:38:50 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 467 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:37 UTC	244	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2e 77 65 6c 6c 2d 6b 6e 6f 77 6e 2f 77 65 62 2d 69 64 65 6e 74 69 74 79 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/.well-known/web-identity">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.5	50161	142.251.167.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Mon, 15 Jan 2024 23:16:37 GMT Date: Mon, 15 Jan 2024 23:16:37 GMT Cache-Control: private, max-age=3600 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-mlX0-NcZnbCrFX30-qiAuA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	164	IN	Data Raw: 32 64 61 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 2da{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-01-15 23:16:38 UTC	573	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.5	50164	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:37 GMT X-Cache: Error from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: aB2qI_KF3nwNoU68MC5XaCUtiWmxmo86-pXi54Io8wqukuwkz_XYUA==
2024-01-15 23:16:38 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.5	50165	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	2054	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 eb9a7c491927f70f3921f0803caae61c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: HZzZW5TJOCjQPAAze0gaz9wv7d6VkGx-WoqPdHoqgpnbVqES9dv1wg==
2024-01-15 23:16:38 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.5	50166	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3255	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|2531&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9c88a3ab97b40043&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJEwvBnQ3g_7lcpNh_XW6WeUeK8Y7iGnBc x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: n8UQALECqwbCKF-TO9r_7YVFl0m_miG37g0uN3HKOxGBHYZNAhiozA==
2024-01-15 23:16:38 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.5	50168	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3295	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1366 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	1366	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 30 7d 2c 7b Data Ascii: {"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_preselected":0},{
2024-01-15 23:16:38 UTC	1185	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCo%2F8NYDXFxoG%2BOhLnybHC8trYVjKer5cfqWUNvRVx15KxuOb6YRDFpP3xAIjtOdIyOOWYO71LDCz7SrcpPdAi90ICFKCt%2BwkLy3JgA%2FPR%2FSKcMSWou2%2BQUnztF%2Bk0DAafGgad%2BczJwyTidrGJf8qHrUJMC0IMzVtPI%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a11ca3ab28340a21&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssCujM0sqUJQlETs4FWJpubjOPB5FUqNgA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: JX3pI3t8d0iChj4cB1ceaPI-GMFTRj9lRflAxcw0vz24OnipHYUgYw==
2024-01-15 23:16:38 UTC	21	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 63 6f 64 65 22 3a 39 7d Data Ascii: {"status":0,"code":9}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.5	50167	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 527 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	527	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 61 72 64 22 3a 5b 5d 2c 22 70 61 67 65 5f 72 65 67 69 6f 6e 22 3a 22 49 6e 64 65 78 50 61 67 65 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 42 55 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 Data Ascii: {"action_name":"webcoreux.global_alert_component_served","action_version":"2.0.0","content":{"global_alert_card":[],"page_region":"IndexPage","vertical":"ABU"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_t
2024-01-15 23:16:38 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3V2IFezHg98eXV41pFu8R1CM9G2fzy3n%2BChDm7Q54COe0SvYQNr6AlxdPHdiFA29Yt3lKYyvmtYj66sTwoi8jMb0opd32M7mqaKC5wKge7Y40o%2F9xsqv4W9YkjTooQyp8k4gBalPHGngJCH6pRwtrdXZiB2Hm%2BVG7I%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5182a3abcb1a0136&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstQxbeNKpa1XrtIQJ5nrYhWK7ryYwqX4MM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: uzKm5bf3inHXCfm7AIjeMbt-jKi1-bfB6Xz1L5f6_Vde2BQxQHGIwA==
2024-01-15 23:16:38 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.5	50170	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 822 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	822	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 62 61 6e 6e 65 72 5f 61 63 74 69 6f 6e 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 69 6e 64 65 78 22 3a 30 2c 22 61 63 74 69 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 62 6f 6f 6b 69 6e 67 2d 68 6f 6d 65 2f 69 6e 64 65 78 2e 65 6e 2d 75 73 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"booking_home","design_variant":"booking_home","banner_action":[{"action_index":0,"action_url":"https://www.booking.com/booking-home/index.en-us.html?aid=30
2024-01-15 23:16:38 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedAHcdZRfm6UkL7OxOa4k3gCrDXpWUyhl77YwiWU42YbsabmSvq4aD1y8WO8pcnV7MHsO3q%2FghGwtpTIUC9mLT7h3gaysG9E9bsTcqo4hhjW8aY%2Bxb3%2BWY1A1ay7mEyqF1BdM3fdhDfMGr0HaRgBtyRgD651UK0eIc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ddefa3abc9530722&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu_BdWXQOcPgCUkmLm4wyKtcvCy9KTuC8A x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: a9Pecxnl3kKoN5f7c_yPUqI0ZW7J57lTBaTt7Mrnv46O_XlPEwMnmA==
2024-01-15 23:16:38 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.5	50171	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	3295	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1381 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:37 UTC	1381	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 68 65 61 64 65 72 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 73 75 62 68 65 61 64 65 72 22 2c 22 Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"genius_sign_in_banner","design_variant":"genius_sign_in_banner","title":"gex_w_index_white_banner_header","subtitle":"gex_w_index_white_banner_subheader","
2024-01-15 23:16:38 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3V2IFezHg98eXV41pFu8R1CM9G2fzy3n%2BChDm7Q54COe0SvYQNr6AlxdPHdiFA29Yt3lKYyvmtYj66sTwoi8jMb0opd32M7mqYcQWBuEKCe9n1BuHiIeD6rJAl%2FL%2BhoFNVbPjArfFXik5nxLuZZz0l6Ncm1KGHzuHs%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5182a3abaf4a027c&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstQxbeNKpa1Xm5_H1CCOujDcIXqvrYNS0U x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: hR5nAXzVtKfGvK5yC-8ZtQTS71tMHqJyQqpGyE8XjRYiGBMPgK1D5Q==
2024-01-15 23:16:38 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.5	50169	142.251.167.100	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:37 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	463	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:38 GMT Expires: Mon, 15 Jan 2024 23:46:38 GMT Cache-Control: public, max-age=1800 Server: sffe Content-Length: 251 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.5	50173	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	4384	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d4b2a3ab01d00374&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLulzg7RfUXnPEbT62_keh8kad8UhMG4rk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: SOWdr0aQ2HPpuBUp0fY7EZs32KTvPqPDp2OHxqQD2JfBa2RUI1KU6A==
2024-01-15 23:16:38 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.5	50174	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3570	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 7ceca3a89c6d001e accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-01-15 23:16:38 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2ae9a3ab1a6b0103&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGe12w2CeFSnHysBZgm5dCuSHtZS91VLn7Q x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: HDfx8ZOZc5F44aluA4mN-JMh2LS5rD73pi3ZoqzI8fktzJJF9-QcHQ==
2024-01-15 23:16:38 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c Data Ascii: {"data":{"trackAdStatus":{"appliedDirectives":[],"directives":[],"description":"A JSON scalar","name":"JSON","directivesByName":{},"allAppliedDirectivesByName":{},"extensionDefinitions":[],"allDirectivesByName":{},"childrenWithTypeReferences":{"empty":fal

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.5	50175	172.253.63.132	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 0bc83a5be386a6200edf12c709bbfe62.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Mon, 15 Jan 2024 23:16:38 GMT Expires: Tue, 14 Jan 2025 23:16:38 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:38 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-01-15 23:16:38 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.5	50176	172.253.122.105	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	651	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: application/json Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 Date: Mon, 15 Jan 2024 23:16:38 GMT Expires: Tue, 16 Jan 2024 23:16:38 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:38 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.5	50178	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1307	OUT	GET /pagead/viewthroughconversion/988382855/?random=1705360597783&cv=11&fst=1705360597783&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 39 31 37 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 917(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	533	IN	Data Raw: 78 33 64 31 37 30 35 33 36 30 35 39 37 37 38 33 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 71 78 62 5f 43 4b 4c 62 72 59 41 44 45 49 65 4e 70 74 63 44 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 42 Data Ascii: x3d1705360597783\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3dqxb_CKLbrYADEIeNptcD\x26frm\x3d0\x26tiba\x3dB
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.5	50181	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3672	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-01-15 23:16:38 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXM5xILsmTuK9yovbZwzJFnX5k2R25IjPmAvx%2ByZR4mSSF6ysfKup2OhzGrKYa0lj2bLawdYvkIkE92e4xm5bEHmg4aM8CkkJamlOjy06OGFxI%2FF2emJ0fEzmhtfJoehViHoFquoGvA8Y5E7%2BN%2Bidh2w%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1f08a3abab0f0173&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGUVQ5roHjzJbMJ3HLhlIOd46oomFxMOrmg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: a3MjjnxZTWhuf8gUYUIl1yZhNflpiAjd4MqmExYVOftC0lNYBBvXJA==
2024-01-15 23:16:38 UTC	15285	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 2c 22 68 65 61 64 69 6e 67 22 3a 22 42 72 6f 77 73 65 20 62 79 20 70 72 6f 70 65 72 74 79 20 74 79 70 65 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 66 69 6c 74 65 72 73 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 64 65 73 69 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"subHeading":null,"carouselCampaignId":"de870e3a-ba91-4605-9bb1-61ead1afc684","heading":"Browse by property type","__typename":"MerchCarousel","filtersInfo":null,"desi
2024-01-15 23:16:38 UTC	1047	IN	Data Raw: 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 78 70 68 6f 74 6f 2f 3c 53 49 5a 45 3e 2f 34 35 34 35 30 30 37 35 2e 6a 70 65 67 3f 6b 3d 64 32 33 63 66 38 34 34 33 37 38 30 61 63 30 39 66 34 36 66 35 39 65 34 30 33 39 33 64 37 35 64 62 65 36 34 62 30 36 30 32 39 62 34 39 35 39 63 36 30 62 38 31 62 37 66 64 65 66 63 39 62 65 30 26 6f 3d 22 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 49 74 65 6d 22 2c 22 72 65 76 69 65 77 53 63 6f 72 65 22 3a 6e 75 6c 6c 2c 22 70 72 69 63 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 22 53 65 6c 66 2d 63 61 74 65 72 69 6e 67 20 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 7d 2c 7b 22 72 Data Ascii: bstatic.com/xdata/images/xphoto/<SIZE>/45450075.jpeg?k=d23cf8443780ac09f46f59e40393d75dbe64b06029b4959c60b81b7fdefc9be0&o="},"__typename":"MerchCarouselStackedItem","reviewScore":null,"price":null,"filters":null,"title":"Self-catering Accommodations"},{"r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.5	50180	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1015	OUT	POST /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=124265061.1705360598&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:38 UTC	817	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=124265061.1705360598&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.5	50184	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3672	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-01-15 23:16:38 UTC	1094	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCohuetrsqNep%2FZyJD506MqiUTw3hc1UUsJVhA4uAkOuFUB7YJ4879afj1IVOrIyraOZZKwacmPQNn4Gv8MaEvLPDbB0JQUwFV1dKRV%2B69mmqVqsFaSyEuE3SKkz3mO7fGB3b4BvOSneZ%2FTrM775wPEpiQVbsn0Rkls%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=15c5a3ab4e1b02cb&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcX-l0ZeZuj2htK3dWErgPvLAATZN8I5Ag x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: gfLP8xY4dpj_JvS6oCjDU2e5VQo_298BXE18lDW3Eq62lfc2dmVXPA==
2024-01-15 23:16:38 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 68 65 61 64 69 6e 67 22 3a 22 45 78 70 6c 6f 72 65 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d 65 72 69 63 61 22 2c 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 63 61 72 6f 75 73 65 6c 4c 61 79 6f 75 74 22 3a 22 44 45 53 4b 54 4f 50 5f 53 4d 41 4c 4c 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 22 54 68 65 73 65 20 70 6f 70 75 6c 61 72 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 68 61 76 65 20 61 20 6c 6f 74 20 74 6f 20 6f 66 66 65 72 22 2c 22 70 72 69 63 65 54 65 78 74 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"heading":"Explore United States of America","designVariant":{"carouselLayout":"DESKTOP_SMALL","subHeading":"These popular destinations have a lot to offer","priceText

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.5	50185	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3570	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 540 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 7ceca3a89c6d001e accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	540	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 63 61 6d 70 61 69 67 6e 49 64 5c 6e 20 20 20 20 63 61 72 6f 75 73 65 6c 4e 61 6d 65 5c 6e 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 73 75 62 74 69 74 6c 65 5c 6e 20 20 20 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 20 20 69 6d 61 67 65 55 72 6c 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 64 69 73 74 61 Data Ascii: {"operationName":"TripTypeDestinations","variables":{},"extensions":{},"query":"query TripTypeDestinations {\n tripTypeDestinations {\n campaignId\n carouselName\n title\n subtitle\n destinations {\n imageUrl\n title\n dista
2024-01-15 23:16:39 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 38 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBL0fnqjd4vBkGa8rkZCO4za76iSeNA5%2FgLcDIfU7qSCf%2FOrqlZw3MtZubrD89FViMejbhkdwDzYmUM4iOhj1EfJzdanZXPQdyLu3rIC0kqVm%2FUMTzIb8vX557Fv4vUZWdn%2BIpdDtMQYwe%2FmhX2KdDRrKqui%2BKIQHQY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5ea1a3abecda0002&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGaaKHadQp2l-2l5TGvlZz1VlEf7ZA7EJAw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: j-EBvPTNdm9ujQdZTVuGEUJ54EP88a6gRCM0WSQ6cBOtEP1NPcqk8Q==
2024-01-15 23:16:39 UTC	38	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 3a 6e 75 6c 6c 7d 7d Data Ascii: {"data":{"tripTypeDestinations":null}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.5	50187	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3672	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 30 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":60}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:39 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 13100 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:38 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefMvczxpucXA9agIxPmByNb8h833XPhYhm8kYavHN62Tg221d1X5ue9ToKTKiIOmH3JifaUmyZNs9RNLnZ4GuS67iaH5OAsE9bu7vjkHBcNtjjk79HZNet02JK1GulvxYfvN1h%2FU04ViphRjtyVEuqgo%2FOtSCjILSk%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5f80a3abd862000b&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGURt3UxnhB_zchQP6Ka1ro0wU5fpV4F0yA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 7HHiqXNZYbohSaiGuKcRIKEkHm3skPwI8mBhHSIcAXJte_MapgLRcg==
2024-01-15 23:16:39 UTC	13100	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 68 61 73 41 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 74 72 75 65 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 46 72 6f 6d 20 63 61 73 74 6c 65 73 20 61 6e 64 20 76 69 6c 6c 61 73 20 74 6f 20 62 6f 61 74 73 20 61 6e 64 20 69 67 6c 6f 6f 73 2c 20 77 65 20 68 61 76 65 20 69 74 20 61 6c 6c 22 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 7b 22 63 68 65 63 6b 6f 75 74 22 3a 22 22 2c 22 73 6f 72 74 65 72 22 3a 6e 75 6c 6c 2c 22 63 Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"__typename":"AcidCarouselOutput","hasAvailability":true,"subtitle":"From castles and villas to boats and igloos, we have it all","landingOptions":{"checkout":"","sorter":null,"c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.5	50186	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1746	OUT	GET /pagead/viewthroughconversion/1060768846/?random=1705360597923&cv=11&fst=1705360597923&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 61 65 39 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: ae9(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	999	IN	Data Raw: 33 64 31 37 30 35 33 36 30 35 39 37 39 32 33 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 68 6c 5c 78 33 64 65 6e 5c 78 32 36 67 6c 5c 78 33 64 75 73 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 36 4f 45 76 43 4b 61 5a 33 77 4d 51 7a 70 6a 6f 2d 51 4d 5c 78 32 Data Ascii: 3d1705360597923\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26hl\x3den\x26gl\x3dus\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3d6OEvCKaZ3wMQzpjo-QM\x2
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.5	50182	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1366	OUT	GET /activity;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	1308	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.5	50183	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1461	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source;navigation-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"11607997710601806417"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11575586014179040999","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"11607997710601806417","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"11607997710601806417","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"11607997710601806417","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"11607997710601806417","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:16:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.5	50190	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3672	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1794 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	1794	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 2c 22 64 61 74 65 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 32 30 32 34 2d 30 31 2d 31 35 22 2c 22 63 68 65 63 6b 6f 75 74 22 3a 22 32 30 32 34 2d 30 31 2d 31 36 22 7d 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2,"dates":{"checkin":"2024-01-15","checkout":"2024-01-16"}},"acidCarouselContext":{"acidCarouselId":67}}},"extensions":{},"query":"query AcidCarouselSearch($input:
2024-01-15 23:16:39 UTC	1092	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 7506 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZffdFYUb5BmRQOZ5nvQXOCsJDN7qRY5c0wircgxHwzhflz%2BcpxivV6zDDZZla0VuvZxiiwJtDC5hxp5YpsnqwUcyr4o7ZM4xGkGdRVkOKQ%2FNEQY3bDTmJsodnZaLEk2odKsbMVWtwy18nFzTZaLFHEuc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=036ea3aba4e40569&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXUSQSgAoO9r1uyTDqD1cI3VBiHtYEBB0w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: U_0iF0Tmy4speeM-hzndWvgWo5G7j-3g-YbALwGkXfbR9Iv93Wfgug==
2024-01-15 23:16:39 UTC	7506	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 32 30 32 34 2d 30 31 2d 31 35 22 2c 22 63 68 65 63 6b 6f 75 74 22 3a 22 32 30 32 34 2d 30 31 2d 31 36 22 2c 22 6e 62 52 6f 6f 6d 73 22 3a 30 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 2c 22 70 61 67 65 22 3a 22 53 45 41 52 43 48 5f 52 45 53 55 4c 54 53 5f 50 41 47 45 22 2c 22 74 72 61 76 65 6c 50 75 72 70 6f 73 65 22 3a 30 2c 22 64 65 73 74 54 Data Ascii: {"data":{"searchQueries":{"searchAcidCarousel":{"title":null,"__typename":"AcidCarouselOutput","landingOptions":{"checkin":"2024-01-15","checkout":"2024-01-16","nbRooms":0,"__typename":"LandingOptions","page":"SEARCH_RESULTS_PAGE","travelPurpose":0,"destT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.5	50189	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1306	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360597967&cv=11&fst=1705360597967&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 39 31 33 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 913(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	529	IN	Data Raw: 64 31 37 30 35 33 36 30 35 39 37 39 36 37 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 38 47 52 79 43 4a 33 45 71 31 67 51 37 4e 61 6d 30 41 4d 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 42 6f 6f 6b Data Ascii: d1705360597967\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3d8GRyCJ3Eq1gQ7Nam0AM\x26frm\x3d0\x26tiba\x3dBook
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.5	50192	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1306	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360598000&cv=11&fst=1705360598000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 39 31 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 914(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	530	IN	Data Raw: 64 31 37 30 35 33 36 30 35 39 38 30 30 30 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 4c 4a 58 71 43 4b 44 45 71 31 67 51 37 4e 61 6d 30 41 4d 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 42 6f 6f 6b Data Ascii: d1705360598000\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3dLJXqCKDEq1gQ7Nam0AM\x26frm\x3d0\x26tiba\x3dBook
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.5	50195	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	3672	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:38 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 35 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":57}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:39 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 204 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3XHJr8W1Z7GYsg4DDr7tFZfT3zdJxyows9iAnUABBbpJvCP7rJp%2FS639s0Ybm0KJ%2FJfcow%2FHoPhHt9AVHwvV3158HipbYCg2JIPjvRIYnJSi1AIz8IfXHc7A25TIzO36gDTFFsNIVs%2FTVAIRr5MyqW2lXePF4E9JVM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7b07a3ab19f60178&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXaIc1qQTBO27tgW3QZWQUoeY4fjM_wPAg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 6MGlVGmXFXAQ_shDZbrx3ws8_LpMuqTt6woSqrjuTLi-HhN2032Mow==
2024-01-15 23:16:39 UTC	204	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 6e 75 6c 6c 2c 22 73 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 61 63 69 64 43 61 72 64 73 22 3a 5b 5d 2c 22 68 61 73 41 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 66 61 6c 73 65 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 7d 7d 7d Data Ascii: {"data":{"searchQueries":{"searchAcidCarousel":{"landingOptions":null,"subtitle":null,"title":null,"__typename":"AcidCarouselOutput","acidCards":[],"hasAvailability":false},"__typename":"SearchQueries"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.5	50194	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1306	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360598042&cv=11&fst=1705360598042&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 39 31 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 914(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	530	IN	Data Raw: 64 31 37 30 35 33 36 30 35 39 38 30 34 32 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 42 63 57 39 43 4f 61 57 73 46 67 51 6b 34 47 68 30 51 4d 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 42 6f 6f 6b Data Ascii: d1705360598042\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3dBcW9COaWsFgQk4Gh0QM\x26frm\x3d0\x26tiba\x3dBook
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.5	50197	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	1306	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360598079&cv=11&fst=1705360598079&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:38 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:38 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:38 UTC	549	IN	Data Raw: 39 31 33 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 913(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:38 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:38 UTC	529	IN	Data Raw: 64 31 37 30 35 33 36 30 35 39 38 30 37 39 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 5c 78 32 36 6c 61 62 65 6c 5c 78 33 64 6d 7a 6d 70 43 4d 62 41 71 31 67 51 6b 34 47 68 30 51 4d 5c 78 32 36 66 72 6d 5c 78 33 64 30 5c 78 32 36 74 69 62 61 5c 78 33 64 42 6f 6f 6b Data Ascii: d1705360598079\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2F\x26label\x3dmzmpCMbAq1gQk4Gh0QM\x26frm\x3d0\x26tiba\x3dBook
2024-01-15 23:16:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.5	50198	172.253.63.138	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	641	OUT	HEAD /about/enterprise/ HTTP/1.1 Host: marketingplatform.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	887	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Content-Length: 125161 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/marketing_platform Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/marketing_platform" Report-To: {"group":"uxe-owners-acl/marketing_platform","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/marketing_platform"}]} Date: Mon, 15 Jan 2024 23:16:38 GMT Expires: Mon, 15 Jan 2024 23:16:38 GMT Cache-Control: private, max-age=3000 Last-Modified: Tue, 09 Jan 2024 09:58:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.5	50199	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:38 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2306 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:38 UTC	2306	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6d 56 4f 6a 57 7a 45 48 41 41 41 41 3a 31 2f 51 4f 6a 66 78 70 37 38 4b 4c 54 6f 4d 48 55 55 71 43 2f 4f 35 48 6e 53 53 6b 30 51 78 51 56 56 38 78 4a 35 31 30 62 68 4d 4c 2b 69 50 4f 79 6b 52 6d 63 79 6c 58 36 7a 73 6e 45 6d 74 68 48 66 65 75 49 62 74 76 44 4c 64 49 49 37 30 64 70 33 58 33 32 7a 64 76 66 69 48 54 68 46 30 72 56 43 32 71 58 35 6c 48 45 2f 45 4c 56 71 76 46 54 76 47 7a 78 6a 50 4d 2f 55 37 30 63 36 77 79 39 69 30 4e 6e 61 78 32 5a 58 50 37 44 49 74 58 4a 77 42 43 33 30 39 68 35 4f 4f 33 68 66 64 69 63 57 41 58 4b 35 41 63 64 49 79 38 78 6f 4e 56 6c 54 69 79 79 65 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyye
2024-01-15 23:16:39 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 948 Connection: close Date: Mon, 15 Jan 2024 23:16:38 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd6-6351ffb915b4c90a724e688c X-Cache: Miss from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: utwT6YT-JIGO09RuD-rXDcmK-Y26n9w_ii5Q9b-jMFz6Fnp3WLXmsA==
2024-01-15 23:16:39 UTC	948	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 36 75 68 2b 69 35 4e 41 41 41 41 3a 4d 45 56 72 34 78 2b 51 78 4e 39 4f 2b 55 31 62 43 4f 65 69 30 76 31 6a 58 4e 4c 6d 43 6a 46 7a 72 2f 36 62 2b 70 49 70 6f 4c 2b 44 6d 6e 59 32 53 38 69 45 75 52 4f 4a 63 46 5a 75 70 69 6a 4b 6b 2b 2b 44 56 76 66 6b 42 76 53 72 7a 6e 4b 44 6b 48 35 35 70 64 32 56 51 53 78 73 50 67 62 2f 39 55 70 39 59 34 79 74 5a 7a 78 67 34 61 56 57 62 37 6a 48 2b 75 75 54 61 65 65 78 31 43 48 2f 63 50 42 71 4c 71 71 71 50 50 4c 62 42 6f 49 73 78 47 4c 42 41 62 31 72 4b 65 5a 79 46 67 4e 38 73 68 4e 45 68 7a 62 49 57 5a 56 55 2b 34 59 35 6d 42 62 39 34 52 44 73 54 4b 73 4e 42 55 72 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+i5NAAAA:MEVr4x+QxN9O+U1bCOei0v1jXNLmCjFzr/6b+pIpoL+DmnY2S8iEuROJcFZupijKk++DVvfkBvSrznKDkH55pd2VQSxsPgb/9Up9Y4ytZzxg4aVWb7jH+uuTaeex1CH/cPBqLqqqPPLbBoIsxGLBAb1rKeZyFgN8shNEhzbIWZVU+4Y5mBb94RDsTKsNBUr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.5	50201	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	856	OUT	GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:39 UTC	783	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_O0wv-8htkv-ARseb33UWk-d3xF53EJOcaQOJvH0r1TdXdMmt&random=2158629236 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.5	50202	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	876	OUT	GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=124265061.1705360598&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:39 UTC	652	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.5	50203	142.251.16.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:39 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:39 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-Hxb5X5kp4F5wAuMSltyWmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:39 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-01-15 23:16:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.5	50207	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 489 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:39 UTC	489	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 64 33 34 37 39 35 63 2d 61 38 38 30 2d 34 35 34 38 2d 62 64 37 38 2d 65 35 36 66 66 35 66 61 39 37 33 33 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 Data Ascii: {"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"0d34795c-a880-4548-bd78-e56ff5fa9733"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_title":"Booking.com \|
2024-01-15 23:16:39 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BifKT5xLGIowgEsQ3Kq8rRlnON09mVviKAHNtOZFB%2FWD4OPI6XG6PX58mNKg47TMIaaVYwrNkMREUrStmrG49qEuaFpAFcUP1Vjd8IgQGeeha2wBg56baAQc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=551fa3abafe601bd&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsttlaSB1x0CzsjgbOF3iiWZcPl7NY4U6sA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: xZLKBA3XHzo1f821S46PwQwcML-L_krnOEm7mTVZC4bqkptNonyrIQ==
2024-01-15 23:16:39 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.5	50205	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1400	OUT	GET /activity;dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:39 UTC	1254	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.5	50209	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:39 UTC	564	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:39 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 185 x-envoy-upstream-service-time: 36 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:39 UTC	185	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 31 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"1","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.5	50204	216.239.36.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	2959	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=124265061.1705360598&sst.gcd=11l1l1l1l5&sst.tft=1705360596915&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=6130&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0
2024-01-15 23:16:39 UTC	568	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: 78c35fbd67c0f6306d57489f0ae31e8b Date: Mon, 15 Jan 2024 23:16:39 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:39 GMT Connection: close
2024-01-15 23:16:39 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.5	50208	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1633	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=826270f9-62fe-4a6d-be16-94d618ec54f0&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=2768&m_fcps=2531&m_pi=2714&m_pl=4615&m_pv=2&m_rd=6224&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=8cdddd56-5cf7-41c3-af77-7a029b3c4e56&ts=1705360598553&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:39 UTC	526	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:39 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:39 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.5	50212	172.253.115.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 139 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:39 UTC	139	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 31 35 37 35 35 38 36 30 31 34 31 37 39 30 34 30 39 39 39 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"11575586014179040999"},"type":"trigger-no-matching-source"}]
2024-01-15 23:16:39 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:39 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.5	50211	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:39 UTC	507	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 32 62 39 33 31 32 31 2d 63 66 66 33 2d 34 34 33 35 2d 61 63 33 61 2d 36 65 61 65 63 36 30 31 65 35 36 30 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 69 74 6c Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"02b93121-cff3-4435-ac3a-6eaec601e560"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_titl
2024-01-15 23:16:39 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPed%2FC0goELZmdg7TezI1SUJ0mvwhiCIP63RX6enctDI1d%2FRLQZWTlxmGcxTXSggwoeq7QLTf4DfglLjeQzRaaOfMsD4oFjFB45%2Fi%2ByrgIRJthJN7DGKUduuCX0r8Z6D7buISFnbqhgJ48uSPfKOjD3CsLpc8Eg42Pqs%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=85cda3ab036e0040&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssnn4K6AvRBCnLKKDN8Br6gvtNdFYXzAgA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: urPo4VAEK3QJmFz3zN_z0pmE6N2517VzWKJy1YLyp65XNhg-9qgeSA==
2024-01-15 23:16:39 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.5	50210	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1238	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=3khr2lf4oy09 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:39 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:39 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-ENhG97CmX10n-uCi7Xy1mw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:39 UTC	361	IN	Data Raw: 32 61 36 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2a63<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 46 46 2c 20 55 2b 32 30 32 30 2c 20 55 2b 32 30 41 30 2d 32 30 41 42 2c 20 55 2b 32 30 41 44 2d 32 30 43 46 2c 20 Data Ascii: boto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF,
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 Data Ascii: font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-sty
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 37 34 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a Data Ascii: to/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d Data Ascii: * vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 37 43 6d 58 31 30 6e 2d 75 43 69 37 58 79 31 6d 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 45 4e 68 47 39 Data Ascii: 7CmX10n-uCi7Xy1mw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js" nonce="ENhG9
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 65 6d 37 70 69 64 66 31 39 59 5a 62 69 31 6a 69 4b 2d 6b 58 4d 34 6e 45 75 6f 6b 74 6b 69 34 59 7a 70 62 54 4a 70 64 4c 55 31 61 6f 4a 33 51 43 5f 6a 54 2d 4c 75 30 6d 6a 49 72 48 49 53 6d 37 41 52 6a 6a 46 2d 63 6d 55 31 4f 69 4b 30 78 42 76 53 51 45 75 36 51 77 63 68 78 47 43 35 6a 46 73 47 4d 52 42 42 58 67 49 5f 31 4a 71 75 38 43 38 6c 31 5a 69 6f 68 4c 37 50 5a 32 45 69 59 55 33 4a 37 47 34 76 61 70 57 30 79 73 6e 76 6d 79 32 38 5f 51 75 4e 4a 52 69 4d 49 6f 54 74 71 39 5a 53 55 46 78 45 61 39 4f 51 49 34 56 6e 6f 39 71 64 55 63 30 51 37 66 66 32 35 32 5f 4c 2d 2d 44 50 66 44 61 71 38 73 54 36 53 56 77 7a 6e 41 2d 42 49 31 54 54 33 4a 31 35 35 73 76 69 4f 41 53 59 58 6d 31 59 69 75 6d 74 32 41 75 32 74 63 39 55 4d 39 38 53 48 4c 35 48 53 79 67 7a 2d Data Ascii: em7pidf19YZbi1jiK-kXM4nEuoktki4YzpbTJpdLU1aoJ3QC_jT-Lu0mjIrHISm7ARjjF-cmU1OiK0xBvSQEu6QwchxGC5jFsGMRBBXgI_1Jqu8C8l1ZiohL7PZ2EiYU3J7G4vapW0ysnvmy28_QuNJRiMIoTtq9ZSUFxEa9OQI4Vno9qdUc0Q7ff252_L--DPfDaq8sT6SVwznA-BI1TT3J155sviOASYXm1Yiumt2Au2tc9UM98SHL5HSygz-
2024-01-15 23:16:39 UTC	1252	IN	Data Raw: 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 59 31 6c 43 54 7a 46 32 59 6d 70 56 4f 57 74 44 4d 44 6c 6c 61 44 5a 52 4e 47 34 77 57 54 68 48 54 6d 78 36 52 6a 42 6b 54 31 46 54 5a 6e 6b 33 52 53 74 56 52 56 5a 59 62 57 6c 34 56 57 70 33 51 6c 4d 31 53 6c 63 32 61 32 35 4d 62 6a 42 73 4f 44 46 4a 63 45 46 43 53 55 56 73 56 6a 56 78 4e 30 70 56 4d 47 4d 34 61 55 49 77 55 33 52 5a 61 32 6b 72 4f 55 34 34 64 32 45 30 51 6d 68 57 4e 46 4d 30 56 57 73 30 64 33 42 4f 4e 54 Data Ascii: x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz\x22,\x22\x22,\x22Y1lCTzF2YmpVOWtDMDllaDZRNG4wWThHTmx6RjBkT1FTZnk3RStVRVZYbWl4VWp3QlM1Slc2a25MbjBsODFJcEFCSUVsVjVxN0pVMGM4aUIwU3RZa2krOU44d2E0QmhWNFM0VWs0d3BONT
2024-01-15 23:16:39 UTC	482	IN	Data Raw: 52 52 43 39 61 62 7a 64 36 4d 6d 6f 78 4d 44 4e 47 4f 45 77 33 52 48 56 6e 64 6c 52 33 54 6a 46 6a 56 6b 51 78 53 56 56 55 53 54 56 55 61 47 34 76 51 31 5a 57 61 58 49 77 5a 6b 59 31 54 46 41 7a 63 45 39 48 52 31 4a 72 54 45 5a 57 63 32 52 50 5a 53 39 55 55 58 46 74 4e 48 56 4b 52 32 68 71 54 48 4a 69 5a 6d 35 45 55 46 56 32 52 31 68 32 4e 48 4e 43 57 48 46 48 52 32 73 35 56 54 4e 6b 63 58 52 78 53 32 31 4e 4e 44 6c 51 4e 31 46 52 57 56 70 6f 64 33 63 79 64 31 45 33 54 6b 35 53 4d 30 31 6e 55 33 4a 33 53 33 4e 4d 4e 6b 35 78 62 6e 5a 55 55 54 64 6e 4e 32 5a 4d 4d 44 4a 33 63 32 4e 36 4d 6b 5a 31 59 6c 4a 7a 55 6b 64 5a 5a 6b 59 34 4d 44 4e 48 61 56 64 51 59 6b 64 70 57 6d 64 45 55 56 6c 78 4d 6c 49 32 4e 33 70 43 62 31 70 78 55 44 46 43 4e 6b 6b 72 54 57 Data Ascii: RRC9abzd6MmoxMDNGOEw3RHVndlR3TjFjVkQxSVVUSTVUaG4vQ1ZWaXIwZkY1TFAzcE9HR1JrTEZWc2RPZS9UUXFtNHVKR2hqTHJiZm5EUFV2R1h2NHNCWHFHR2s5VTNkcXRxS21NNDlQN1FRWVpod3cyd1E3Tk5SM01nU3J3S3NMNk5xbnZUUTdnN2ZMMDJ3c2N6MkZ1YlJzUkdZZkY4MDNHaVdQYkdpWmdEUVlxMlI2N3pCb1pxUDFCNkkrTW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.5	50219	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:39 UTC	507	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 66 65 38 63 66 36 2d 31 63 38 39 2d 34 66 35 37 2d 39 62 38 65 2d 64 64 62 31 30 62 35 64 30 62 66 63 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 69 74 6c Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"32fe8cf6-1c89-4f57-9b8e-ddb10b5d0bfc"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_titl
2024-01-15 23:16:39 UTC	1185	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhCYiP4tlENZkBievsD9k%2FSwsOzLbra3jxBDA1bzuwyAHYvs4SPD1jT%2BAYllrOs%2FiceFIO8fOeIitkVUi%2FzLk3mcP3158dKCewuInpdj9UAKHn%2FHXDUPLrD9nhwvyUoVyxCw%2F9wcZb73fDsdXC4KIq3S6Ef%2FX2CT%2FwI%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=df07a3ab62da013a&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu57_1sXvJB6cLLxpKzdVkhWVypQTxDfBQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: m67c4ZFQAueXhbHbvUSXfUlcAkKy7dW2mG5sZLrpwqNNIBnBfUIJww==
2024-01-15 23:16:39 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.5	50218	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3294	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 544 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:39 UTC	544	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 64 65 73 74 69 6e 61 74 69 6f 6e 5f 72 65 63 6f 6d 6d 65 6e 64 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 6f 73 74 63 61 72 64 73 22 3a 5b 7b 22 75 66 69 22 3a 32 30 30 32 33 34 38 38 7d 2c 7b 22 75 66 69 22 3a 32 30 30 38 38 33 32 35 7d 2c 7b 22 75 66 69 22 3a 32 30 30 37 39 31 31 30 7d 2c 7b 22 75 66 69 22 3a 32 30 30 32 34 38 30 39 7d 2c 7b 22 75 66 69 22 3a 32 30 30 31 34 31 38 31 7d 5d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: {"action_name":"webcoreux.destination_recommender_viewed","action_version":"1.0.0","content":{"postcards":[{"ufi":20023488},{"ufi":20088325},{"ufi":20079110},{"ufi":20024809},{"ufi":20014181}]},"context":{"page":{"page_referrer":"","page_url":"https://www
2024-01-15 23:16:39 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7a4ea3abbf08008b&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsszThsDR-YLJXJyr7ElE0sCyGIy2AUQQyQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: q5byNZrFddopEOeTWq-AUKHaRG0TNHMc4Tvb-yPo23Cp6Qu6t0zL1A==
2024-01-15 23:16:39 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.5	50224	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1047	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360598749&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:39 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 4 referrer-policy: origin x-pinterest-rid: 1858509875242479 Date: Mon, 15 Jan 2024 23:16:39 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:39 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.5	50221	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3570	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 7ceca3a89c6d001e accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fRn5y+FdtjeJfFma4lib4XDCax4YBt3O6i1gMUKBEhGvyyCjSTNPage7NrNju2MgtQ7YXHS2ryD4l0iehxCK; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FiU1r1BzC85TTVFIAPRGIO5BAPnPBhLtfuf3U9esoYMnVybx4he3ldUKt2cy0JOtK72IXQEOEwcnZpwateCv0dgf%2Be%2B7zWhrrPMi7TPh7onJZsL4egSYyoNglXbMIyiD9p20wlriImEjhfFoe5kVRhBp6XMcRH%2Bio%3D; lastSeen=0
2024-01-15 23:16:39 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-01-15 23:16:39 UTC	1094	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 89 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4467a3abaaba027e&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGY_AW1e47lQ3ElpPIVuhgr-8AegvaAZwhw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CyzsdN__AcSafZTboFsV1ool7wnxICtJvMjE_QQzDV_KcsZEMcRfpA==
2024-01-15 23:16:39 UTC	89	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 51 75 65 72 69 65 73 22 2c 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 6e 75 6c 6c 7d 7d 7d Data Ascii: {"data":{"geniusGuestData":{"__typename":"GeniusGuestQueries","signInBottomSheet":null}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.5	50223	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	988	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360598751&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:39 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 8510111464962979 Date: Mon, 15 Jan 2024 23:16:39 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:39 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.5	50222	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3481	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAolULPRVQsjJYzep+iIKb7/ExS1cr32eB/676c9L06fWjMm1Cv4Da/b5NkO/XNmHTRdWXFaNUEhs; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D
2024-01-15 23:16:39 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:39 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b3b7a3abdd0a0447&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKY42biNDD_3LRKeniXovNllvthOTkyjAs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Q8fgRlQB5VHnoOSVrtawJ6y4WElRg_1bDl2L59rsZmRLCWhFfMYE9Q==
2024-01-15 23:16:39 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.5	50226	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2404 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:39 UTC	2404	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 36 75 68 2b 69 35 4e 41 41 41 41 3a 4d 45 56 72 34 78 2b 51 78 4e 39 4f 2b 55 31 62 43 4f 65 69 30 76 31 6a 58 4e 4c 6d 43 6a 46 7a 72 2f 36 62 2b 70 49 70 6f 4c 2b 44 6d 6e 59 32 53 38 69 45 75 52 4f 4a 63 46 5a 75 70 69 6a 4b 6b 2b 2b 44 56 76 66 6b 42 76 53 72 7a 6e 4b 44 6b 48 35 35 70 64 32 56 51 53 78 73 50 67 62 2f 39 55 70 39 59 34 79 74 5a 7a 78 67 34 61 56 57 62 37 6a 48 2b 75 75 54 61 65 65 78 31 43 48 2f 63 50 42 71 4c 71 71 71 50 50 4c 62 42 6f 49 73 78 47 4c 42 41 62 31 72 4b 65 5a 79 46 67 4e 38 73 68 4e 45 68 7a 62 49 57 5a 56 55 2b 34 59 35 6d 42 62 39 34 52 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+i5NAAAA:MEVr4x+QxN9O+U1bCOei0v1jXNLmCjFzr/6b+pIpoL+DmnY2S8iEuROJcFZupijKk++DVvfkBvSrznKDkH55pd2VQSxsPgb/9Up9Y4ytZzxg4aVWb7jH+uuTaeex1CH/cPBqLqqqPPLbBoIsxGLBAb1rKeZyFgN8shNEhzbIWZVU+4Y5mBb94R
2024-01-15 23:16:39 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1036 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:39 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd7-4975a3e94f5ac45d01a2e9b4 X-Cache: Miss from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 6lGjC2lVraLzlfSvDKSiPeahtCvgfkXif6n6jxuiaWcZNC51w6DRAQ==
2024-01-15 23:16:39 UTC	1036	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6c 46 71 69 4b 78 77 70 41 41 41 41 3a 6f 43 37 4d 62 57 58 56 6c 65 6d 54 57 47 41 55 7a 6e 41 36 71 55 49 59 68 35 32 35 71 4e 63 61 46 73 57 72 67 4d 6b 2f 49 37 68 53 4f 37 72 45 38 72 5a 67 2f 2b 55 76 71 72 2b 64 38 49 43 62 4d 74 73 2b 41 50 63 6b 72 56 67 38 68 36 69 32 63 47 50 50 57 6f 4d 57 61 72 58 46 6b 38 52 59 69 52 5a 46 74 6f 4d 4a 54 6d 66 6a 75 56 6b 44 79 65 43 4b 64 72 6d 75 6f 66 6f 44 38 71 59 57 32 4d 76 78 32 46 43 54 52 68 79 75 56 6b 45 32 30 75 42 56 4f 39 52 50 4f 76 47 4d 33 66 63 4e 37 42 70 74 64 50 63 2b 50 48 65 45 48 71 46 4d 59 68 52 68 34 48 47 45 44 75 7a 64 41 6a 51 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.5	50225	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1025	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_O0wv-8htkv-ARseb33UWk-d3xF53EJOcaQOJvH0r1TdXdMmt&random=2158629236 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:39 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.5	50229	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	2315	OUT	GET /gampad/ads?pvsid=1277477425375320&correlator=972839179899800&eid=31079956%2C31080295%2C31080441%2C31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3Df026c47f-f6c4-460b-93fa-1f2190c83402%26affiliate_id%3D304142%26rendered_ad_pageview_id%3D7ceca3a89c6d001e%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3Df927aa320290b431%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ&gpic=UID%3D00000db788c26b0e%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA&abxe=1&dt=1705360597396&lmt=1705360597&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=124&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360597&ga_hid=1177479985&ga_fc=true&ga_cid=1111547412.1705360577&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360593187&idt=773&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1126437992&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:39 UTC	753	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Google-LineItem-Id: -2 Google-Creative-Id: -2 Google-MediationGroup-Id: -2 Google-MediationTag-Id: -2 Date: Mon, 15 Jan 2024 23:16:39 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:39 UTC	498	IN	Data Raw: 31 65 62 0d 0a 7b 22 2f 33 31 30 32 2f 62 63 6f 6d 2d 77 77 77 2f 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 2f 69 6e 64 65 78 2f 69 6e 64 65 78 2d 70 72 69 6d 61 72 79 22 3a 5b 22 68 74 6d 6c 22 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 35 30 2c 33 32 30 2c 31 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 4f 72 59 47 73 6c 58 71 7a 57 78 5a 6e 4d 77 61 31 30 48 68 73 6f 47 35 43 30 61 22 2c 22 43 49 79 5a 6c 61 62 44 34 49 4d 44 46 57 66 51 34 77 63 64 Data Ascii: 1eb{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CIyZlabD4IMDFWfQ4wcd
2024-01-15 23:16:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.5	50232	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	686	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:39 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 31 Dec 2023 04:28:51 GMT ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: JqVS7V_u6AcK_fItljkqy2pUOislvovF0n3v0aWpAmc0VWmYyrAWDg== Age: 1363668
2024-01-15 23:16:39 UTC	8629	IN	Data Raw: 32 31 61 64 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21adJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.5	50233	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	686	OUT	GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:39 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 31 Dec 2023 06:03:59 GMT ETag: "118c01722e55044d816db848ac471d09024e4d85" Content-Language: 10601 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: _ANgU7M8r2EtHyvFUn188aKZ3Aq4abRwO3bwquPpoLXE7HQay4tVLA== Age: 1357960
2024-01-15 23:16:39 UTC	10609	IN	Data Raw: 32 39 36 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2969JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.5	50234	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	686	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 14:48:53 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: YNhtgKmpQAkyZQ546qyloVlEghKGeKzLJxUs6CEq4Nty6TM1HpbkOQ== Age: 2104066
2024-01-15 23:16:40 UTC	10265	IN	Data Raw: 32 38 31 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2811JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.5	50236	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3295	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 502 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAolULPRVQsjJYzep+iIKb7/ExS1cr32eB/676c9L06fWjMm1Cv4Da/b5NkO/XNmHTRdWXFaNUEhs; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D
2024-01-15 23:16:39 UTC	502	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 37 63 65 63 61 33 61 38 39 63 36 64 30 30 31 65 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 34 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 39 32 33 32 39 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 39 32 33 33 32 25 32 43 31 37 30 35 33 36 30 35 39 32 33 39 32 25 32 43 31 37 30 35 33 36 30 35 39 32 33 39 32 25 32 43 31 37 30 35 33 36 30 35 39 32 33 39 32 25 32 43 31 37 30 35 33 36 30 35 39 32 35 39 38 25 32 43 31 37 30 35 33 36 30 35 39 32 33 39 34 25 32 43 31 37 30 35 33 36 30 35 39 Data Ascii: ref_action=index&pid=7ceca3a89c6d001e&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=4&nts=0%2C0%2C1705360592329%2C0%2C0%2C0%2C0%2C1705360592332%2C1705360592392%2C1705360592392%2C1705360592392%2C1705360592598%2C1705360592394%2C170536059
2024-01-15 23:16:40 UTC	1036	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VONbFDWKFtMA35PPXw6%2Fk8EAVIA0DqbSc%2FsZDZgNMY%2FEXhPnNd%2F7iZOYrPGiVz8KXfnJxjoM4OG6QsYBCs1OeEVdIaeqa7vdv3peN3QwquZznD0av%2FjhBVSpHULT2ewNEEuGua1tEj9ROcQ0TyVVhuNkb60Fdq5II%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5740a3ac385400f7&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJv5LJ27QAdsBDPq1qHsZP4zXI32pV01q-8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: okEl4a-lYH9KggbXpzuMjGaKySm-dNEytpRTfM8Xf8sG_QZBIpLBrw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.5	50235	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	686	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 16:09:20 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: YXtRpMI7Ge3jDayZpAqmszu0aWzcY9nX7fRwlncfb42FhFAJSegJNQ== Age: 2099239
2024-01-15 23:16:40 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.5	50239	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3578	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 7ceca3a89c6d001e accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.0.1705360585.60.0.0; _ga_A12345=GS1.1.1705360585.1.0.1705360585.0.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAolULPRVQsjJYzep+iIKb7/ExS1cr32eB/676c9L06fWjMm1Cv4Da/b5NkO/XNmHTRdWXFaNUEhs; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATD5PdP03CWp5%2F5cz3f60q2Ml%2B%2BaI3EDycezUYBtOKw%2Fb873hzJ2a4Y5%2FxyvKzk1vPdoNdykIoxR9mQAesuFWH6RwYD%2B9dYDdiGouAzjMw5ppoCPc8d%2FZ5wOH1FDMsXclO3ru0kwkpsDQ%3D
2024-01-15 23:16:39 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 6e 6f 5f 61 64 5f 72 65 74 75 72 6e 65 64 5f 66 72 6f 6d 5f 67 70 74 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"no_ad_returned_from_gpt","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-01-15 23:16:40 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiZSwbvECKS6KOqRJk5Rvxq5oykQ%2BMaqslg25GTWcutnKtYuJIjDwsKrvE3hr%2BpKNM6aCekA3XlYonPhlAK2vuiB%2FTvX3enzlKcAjEkN7N0lcutkLY62Uc2s%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c458a3acfb830570&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcmYzEvaakSdxKhZH-Ibn4SNlmfO-s6DTw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 99baebf4b5bb631267dcfa82456151cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: WjrqnjmszQRhisiVbsy5rS9VP6mP8x6BTqoq9TlsoNnkh3dQgPmqVw==
2024-01-15 23:16:40 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 Data Ascii: {"data":{"trackAdStatus":{"directives":[],"childrenWithTypeReferences":{"childrenAsList":[],"empty":false,"children":{"directives":[],"appliedDirectives":[]}},"extensionDefinitions":[],"appliedDirectives":[],"name":"JSON","allAppliedDirectivesByName":{},"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.5	50237	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1308	OUT	GET /pagead/1p-user-list/988382855/?random=1705360597783&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_i197d509oLaI9ZobWyNTHpi9mBZMhBCuj3xzghHEWlEbvJ8N&random=4115807802&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.5	50238	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	1746	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360597923&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_fupSUXTRqaTLl3HIjS40PJucnnu-JQRD_0-RDLxHwytskKyq&random=508482912&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.5	50241	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:39 UTC	3647	OUT	GET /js_errors?pid=7ceca3a89c6d001e&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAolULPRVQsjJYzep+iIKb7/ExS1cr32eB/676c9L06fWjMm1Cv4Da/b5NkO/XNmHTRdWXFaNUEhs; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCohuetrsqNep%2FZyJD506MqiUTw3hc1UUsJVhA4uAkOuFUB7YJ4879afj1IVOrIyraOZZKwacmPQNn4Gv8MaEvLPDbB0JQUwFV1dKRV%2B69mmqVqsFaSyEuE3SKkz3mO7fGB3b4BvOSneZ%2FTrM775wPEpiQVbsn0Rkls%3D; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e
2024-01-15 23:16:40 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=091ca3acac9200ef&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpWmFNbjTVq25kUPRfk9wmzoInXbUOAyLM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: -52txuK115qW0i-BTYwKQ--JTPFFWcHV7MMDiUuXbtofX8s85vSCmw==
2024-01-15 23:16:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.5	50242	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	3566	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 7ceca3a89c6d001e accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmVOjWzEHAAAA:1/QOjfxp78KLToMHUUqC/O5HnSSk0QxQVV8xJ510bhML+iPOykRmcylX6zsnEmthHfeuIbtvDLdII70dp3X32zdvfiHThF0rVC2qX5lHE/ELVqvFTvGzxjPM/U70c6wy9i0Nnax2ZXP7DItXJwBC309h5OO3hfdicWAXK5AcdIy8xoNVlTiyyer2yY4MAolULPRVQsjJYzep+iIKb7/ExS1cr32eB/676c9L06fWjMm1Cv4Da/b5NkO/XNmHTRdWXFaNUEhs; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZffdFYUb5BmRQOZ5nvQXOCsJDN7qRY5c0wircgxHwzhflz%2BcpxivV6zDDZZla0VuvZxiiwJtDC5hxp5YpsnqwUcyr4o7ZM4xGkGdRVkOKQ%2FNEQY3bDTmJsodnZaLEk2odKsbMVWtwy18nFzTZaLFHEuc%3D
2024-01-15 23:16:40 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-01-15 23:16:40 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOsi71E01M7sI5kkwBUNhACamyxTR6Rm03NGDvccpS3RN9M9WBwRiIU3ixcUzTo8W6WcbbsA0elSWCGGp%2Fhl2uYgYpSZY5lhgAeOtvxgedcNvXBjvN1Nz55QMbZ803yqWWCvQCfnXPKhEQPElk08YB6%2Bo%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e19ca3ac275d0131&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGViVxvzuBCRPFu52hghwjdd_WjnUugKIVw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 2Y1e98pXomw3A8X3Q0e-Cgp6UeNnfNpprNRFk3n7z6H05FJ3LnSzjQ==
2024-01-15 23:16:40 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b Data Ascii: {"data":{"trackAdStatus":{"appliedDirectives":[],"directivesByName":{},"directives":[],"coercing":{},"childrenWithTypeReferences":{"empty":false,"children":{"appliedDirectives":[],"directives":[]},"childrenAsList":[]},"name":"JSON","allDirectivesByName":{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.5	50240	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1306	OUT	GET /pagead/1p-user-list/973712236/?random=1705360597967&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_k3ZKH6DjHbnIcFRKtJhH8uKkOqptOjvw_cfeueeFL7efLagg&random=599786722&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.5	50243	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:40 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=99fea3acdbb7007e&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstkvsKXTQMYhsZoxWnTdxwWCdNKvHARYeM x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: viqx_XwFn0R2OE8giRix7Xm26i_8PFrlhDFkuoK-lHajaoNz5um0eA==
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.5	50244	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	3668	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZffdFYUb5BmRQOZ5nvQXOCsJDN7qRY5c0wircgxHwzhflz%2BcpxivV6zDDZZla0VuvZxiiwJtDC5hxp5YpsnqwUcyr4o7ZM4xGkGdRVkOKQ%2FNEQY3bDTmJsodnZaLEk2odKsbMVWtwy18nFzTZaLFHEuc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+i5NAAAA:MEVr4x+QxN9O+U1bCOei0v1jXNLmCjFzr/6b+pIpoL+DmnY2S8iEuROJcFZupijKk++DVvfkBvSrznKDkH55pd2VQSxsPgb/9Up9Y4ytZzxg4aVWb7jH+uuTaeex1CH/cPBqLqqqPPLbBoIsxGLBAb1rKeZyFgN8shNEhzbIWZVU+4Y5mBb94RDsTKsNBUrzEFa7LU2ZNI/RmWGtt+uH2wvZFQIeLWBtHLxOwNg1vTRP4/kzPs6ZdaKSb4Uwck6FiXuDJC6f
2024-01-15 23:16:40 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 30 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":60}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:40 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 13100 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W4pr5w8Bwn9gc2YaU9JhVqFRemYlePujGaqxLdjxKjY%2FCl2fxJOW0gPlw6FqzKsmVVe2gwdTDLgoFXJB5MReygNNY3uNaG9KRjqHknoUXKzgRo9zioNxnZd7rhwsdTDBteexGJeQw25uYAAml6urOavWgXrlbFvHY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e532a3ac7df201a4&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXxGQ1zvnWUmp4i0vnioc6U_8oH2D9HfLQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: RdjYG44h3PrDQ3Svc9qwXyOuW99k92jqk1cbwUL-uVLeFPi25M4tsg==
2024-01-15 23:16:40 UTC	13100	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 73 75 62 74 69 74 6c 65 22 3a 22 46 72 6f 6d 20 63 61 73 74 6c 65 73 20 61 6e 64 20 76 69 6c 6c 61 73 20 74 6f 20 62 6f 61 74 73 20 61 6e 64 20 69 67 6c 6f 6f 73 2c 20 77 65 20 68 61 76 65 20 69 74 20 61 6c 6c 22 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 22 2c 22 70 61 67 65 22 3a 22 50 52 4f 50 45 52 54 59 5f 50 41 47 45 22 2c 22 63 68 69 6c 64 72 65 6e 41 67 65 73 22 3a 5b 5d 2c 22 6e 62 52 6f 6f 6d 73 22 3a 30 2c 22 64 65 73 74 49 64 22 3a 30 2c 22 74 72 61 76 65 6c 50 75 72 Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"subtitle":"From castles and villas to boats and igloos, we have it all","landingOptions":{"checkin":"","page":"PROPERTY_PAGE","childrenAges":[],"nbRooms":0,"destId":0,"travelPur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.5	50249	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:40 GMT X-Cache: Error from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: R-JX0UVj6fm1jtYnBJ6qlaislr7waDxVfAu_DVpQf8_9dqJXQFFVOw==
2024-01-15 23:16:40 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.5	50247	172.253.115.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1153	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:40 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"11607997710601806417"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11575586014179040999","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"11607997710601806417","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"11607997710601806417","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"11607997710601806417","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"11607997710601806417","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:16:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.5	50246	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	3893	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:40 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8f4da3ac32ed0093&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejK7egcyYk46yT9ko-xKfzQsbbc_Hm_WaNw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Fu59oKKPFG8hAnRophfveoJAVOSBup7K_hy8bT33kvSeUEJ4vg3KAA==
2024-01-15 23:16:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.5	50248	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1307	OUT	GET /pagead/1p-user-list/973712236/?random=1705360598000&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0hVuuTBfVjc5kWuiD6e2QNxDfNowOiQySAeWQCJYFtu9LAv9&random=3970838727&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.5	50245	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:40 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9031a3ace3ed0233&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRqK8JEyao77I3Qa1wTasCjAdkJvhS3x2Q x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: V5zoAGo7eGhJ8UKPJ1fhA8tP9tbe6T3vEWvyB4fqfzair9QVf2LyTQ==
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.5	50250	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2492 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	2492	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6c 46 71 69 4b 78 77 70 41 41 41 41 3a 6f 43 37 4d 62 57 58 56 6c 65 6d 54 57 47 41 55 7a 6e 41 36 71 55 49 59 68 35 32 35 71 4e 63 61 46 73 57 72 67 4d 6b 2f 49 37 68 53 4f 37 72 45 38 72 5a 67 2f 2b 55 76 71 72 2b 64 38 49 43 62 4d 74 73 2b 41 50 63 6b 72 56 67 38 68 36 69 32 63 47 50 50 57 6f 4d 57 61 72 58 46 6b 38 52 59 69 52 5a 46 74 6f 4d 4a 54 6d 66 6a 75 56 6b 44 79 65 43 4b 64 72 6d 75 6f 66 6f 44 38 71 59 57 32 4d 76 78 32 46 43 54 52 68 79 75 56 6b 45 32 30 75 42 56 4f 39 52 50 4f 76 47 4d 33 66 63 4e 37 42 70 74 64 50 63 2b 50 48 65 45 48 71 46 4d 59 68 52 68 34 48 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4H
2024-01-15 23:16:40 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1124 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:40 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcd8-511ab8fb4ccc252402029959 X-Cache: Miss from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: OvPnInzuo2jIWCTVuWZJBU7XVSbj_Hj6VZcmSqOHLl3lnH7YlFokrQ==
2024-01-15 23:16:40 UTC	1124	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 72 73 2b 69 67 2b 6f 63 41 41 41 41 3a 58 48 37 33 55 43 45 64 4d 75 72 5a 30 76 49 64 79 75 73 31 74 4e 79 35 76 76 37 77 2f 6b 67 6a 39 74 4f 4f 7a 34 72 4e 47 38 4d 66 7a 79 44 34 58 4c 74 30 45 32 49 50 45 4d 61 75 79 2b 32 57 2b 59 6b 2f 34 34 75 43 65 4a 63 6b 6c 4f 31 79 30 6f 43 50 69 78 31 2f 64 77 58 35 51 7a 47 54 43 6a 45 2f 45 48 55 30 39 4d 45 4d 6d 32 65 2b 47 51 69 6b 4c 39 5a 66 36 64 4f 75 46 4f 32 51 6d 70 39 68 37 70 7a 72 43 6e 37 64 68 6b 57 42 7a 6c 67 39 6d 58 2f 41 64 64 4c 5a 4b 4c 44 7a 59 6a 70 68 58 70 53 58 46 69 4f 4d 38 39 65 32 37 50 77 6a 47 30 45 53 47 58 59 61 53 76 49 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.5	50252	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	3668	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZffdFYUb5BmRQOZ5nvQXOCsJDN7qRY5c0wircgxHwzhflz%2BcpxivV6zDDZZla0VuvZxiiwJtDC5hxp5YpsnqwUcyr4o7ZM4xGkGdRVkOKQ%2FNEQY3bDTmJsodnZaLEk2odKsbMVWtwy18nFzTZaLFHEuc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+i5NAAAA:MEVr4x+QxN9O+U1bCOei0v1jXNLmCjFzr/6b+pIpoL+DmnY2S8iEuROJcFZupijKk++DVvfkBvSrznKDkH55pd2VQSxsPgb/9Up9Y4ytZzxg4aVWb7jH+uuTaeex1CH/cPBqLqqqPPLbBoIsxGLBAb1rKeZyFgN8shNEhzbIWZVU+4Y5mBb94RDsTKsNBUrzEFa7LU2ZNI/RmWGtt+uH2wvZFQIeLWBtHLxOwNg1vTRP4/kzPs6ZdaKSb4Uwck6FiXuDJC6f
2024-01-15 23:16:40 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 35 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":57}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:40 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 204 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=437ea3aca7050379&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGei9VX6HWsRothQ8oLHetP3Jmx_bG-_czQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: f6Dz66nwAXoJRHHPwC1th-eJPn0ulCFexIdltfCjJARgBFhilYoI3A==
2024-01-15 23:16:40 UTC	204	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 6e 75 6c 6c 2c 22 73 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 61 63 69 64 43 61 72 64 73 22 3a 5b 5d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 68 61 73 41 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 66 61 6c 73 65 7d 7d 7d 7d Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"title":null,"landingOptions":null,"subtitle":null,"acidCards":[],"__typename":"AcidCarouselOutput","hasAvailability":false}}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.5	50251	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1307	OUT	GET /pagead/1p-user-list/975716499/?random=1705360598042&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_C6dkLDIEgTr3RTf_2TVnFzs80O94zc7a39hyjaqYJl-D_6MN&random=1991363687&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.5	50254	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1746	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360598780 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:40 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:40 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1310215298733485 Date: Mon, 15 Jan 2024 23:16:40 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.5	50255	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 8173 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:44:21 GMT ETag: "42cfdf3fa5f0c7a7aabef8ac84d9d6ceb4ff03ff" Content-Language: 8173 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: YshMcIfFFll1UaRd93laTb0LBvPvs_MnVa8IfDYzhht0D-pcue44Fw== Age: 1535539
2024-01-15 23:16:40 UTC	8173	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.5	50253	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1306	OUT	GET /pagead/1p-user-list/975716499/?random=1705360598079&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gGlxjONdeyxb5OSeeKxPtSTDvscDhWgGEq83Cm0-EZsG__B3&random=714141179&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:40 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.5	50256	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5364 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:55:14 GMT ETag: "1e29d071ab764beece3862fd5d8a1fc1fc3f9b64" Content-Language: 5364 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Jyd-wb0EAXnRAf1FfWt1h4oQY9v8p3A8CdfwnwQwAe4umwNap2nWwQ== Age: 1534886
2024-01-15 23:16:40 UTC	5364	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.5	50257	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Fri, 22 Dec 2023 11:30:54 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: O3RfJelbJuE0HtZV6iVKNAUMuAflFlnnFIabj10E-Ezp8xw41kQiRw== Age: 2115946
2024-01-15 23:16:40 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.5	50258	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1398	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=826270f9-62fe-4a6d-be16-94d618ec54f0&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=2768&m_fcps=2531&m_pi=2714&m_pl=4615&m_pv=2&m_rd=6224&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=8cdddd56-5cf7-41c3-af77-7a029b3c4e56&ts=1705360598553&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:40 UTC	526	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:40 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:40 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.5	50259	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	843	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360598749&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:40 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 1400086045299421 Date: Mon, 15 Jan 2024 23:16:40 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:40 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.5	50260	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	784	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360598751&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:40 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1217506298538916 Date: Mon, 15 Jan 2024 23:16:40 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:40 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.5	50261	216.239.34.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2748	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=124265061.1705360598&sst.gcd=11l1l1l1l5&sst.tft=1705360596915&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=6130&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:40 UTC	474	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: bff2dee89962170890708e16345c2bd5 Date: Mon, 15 Jan 2024 23:16:40 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:40 GMT Connection: close
2024-01-15 23:16:40 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.5	50265	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	3262	OUT	GET /index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:41 UTC	2152	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: User-Agent, Accept-Encoding link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/a12bf6dc9e1123505d5091c7c956f47b05ecf1e9.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/304bf0a6b80d8d5c92ad68e080281ecf5cea78aa.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/7d56b924a6c248d579afe82a520d9a6abc96b9c7.css>; rel=preload; as=style nel: {"report_to":"default","max_age":604800} report-to: {"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800} set-cookie: _implmdnbl=2__1__0; path=/; expires=Wed, 16-Jan-2019 23:16:40 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Wed, 30-Mar-2078 22:33:20 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BRtKHnxHt2mRW%2B%2BAOT5uI%2BlK1nabE0AFD%2BathnduIOfsy6D3EJLONgVSUF1dzZf6t7rOMdlhmZqjsf7WOb5p8hvM9pE6co%2FvGOKc0Mcl%2FqGmQGn8uDIc2PTVog54Iwa4MS1SYcgXi%2FAvc7C8eKLaqgzGZr%2BuOCEIM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:40 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f9efe5e72b7e5cc47bf34a0b0debcbe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: EE3dQYkF3PlBFIoGtfdfVRj6XfB82VsBZuoT9y0MEJIQaINdE6Gkbw==
2024-01-15 23:16:41 UTC	11076	IN	Data Raw: 32 62 33 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 5a 53 48 51 6a 41 62 43 32 64 67 49 77 72 4a 22 Data Ascii: 2b3c<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="ZSHQjAbC2dgIwrJ"
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 35 65 32 61 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 5e2a<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-01-15 23:16:41 UTC	7730	IN	Data Raw: 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 5f 75 6e 74 69 6c 7d 22 2c 22 75 78 5f 64 61 79 5f 6d 6f 6e 74 68 5f 6f 6e 22 3a 22 6f 6e 20 7b 6d 6f 6e 74 68 5f 32 7d 20 7b 64 61 79 5f 32 7d 22 2c 22 64 61 79 5f 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 79 65 61 72 5f 66 72 6f 6d 22 3a 22 66 72 6f 6d 20 7b 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6e 61 6d 65 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 22 2c 22 6e 75 6d 65 72 69 63 5f 64 61 79 5f 6d 6f 6e 74 68 5f 79 65 61 72 22 3a 22 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 5f 30 7d 2f 7b 64 61 79 5f 6e 61 6d 65 5f 30 7d 2f 7b 66 75 6c 6c 5f 79 65 61 72 7d 22 2c 22 64 61 79 5f 6d 6f 6e 74 68 5f 6f 6e 22 3a 22 6f 6e 20 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6e 61 6d 65 7d 22 2c 22 6e 75 6d Data Ascii: , {full_year_until}","ux_day_month_on":"on {month_2} {day_2}","day_short_month_year_from":"from {short_month_name} {day_name}, {full_year}","numeric_day_month_year":"{month_name_0}/{day_name_0}/{full_year}","day_month_on":"on {month_name} {day_name}","num
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 22 6e 61 6d 65 5f 74 6f 22 3a 22 4d 61 72 63 68 22 2c 22 6e 61 6d 65 5f 66 72 6f 6d 22 3a 22 4d 61 72 63 68 22 2c 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 75 63 22 3a 22 54 68 65 20 4d 61 72 63 68 22 7d 2c 22 34 22 3a 7b 22 6d 6f 6e 74 68 5f 32 22 3a 22 41 70 72 69 6c 22 2c 22 74 6f 5f 6d 6f 6e 74 68 5f 6c 63 22 3a 22 74 6f 20 41 70 72 69 6c 22 2c 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 6c 63 22 3a 22 74 68 65 20 41 70 72 69 6c 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 5f 6f 6e 6c 79 22 3a 22 41 70 72 22 2c 22 69 6e 5f 6d 6f 6e 74 68 5f 6c 63 22 3a 22 69 6e 20 41 70 72 69 6c 22 2c 22 6e 61 6d 65 22 3a 22 41 70 72 69 6c 22 2c 22 6e 61 6d 65 5f 6f 6e 6c 79 22 3a 22 41 70 72 69 6c 22 2c 22 67 65 6e 69 74 69 76 65 5f Data Ascii: 3ffa"name_to":"March","name_from":"March","name_def_article_uc":"The March"},"4":{"month_2":"April","to_month_lc":"to April","name_def_article_lc":"the April","short_name_only":"Apr","in_month_lc":"in April","name":"April","name_only":"April","genitive_
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 0d 0a 64 36 62 38 0d 0a 74 69 6f 6e 5f 74 61 67 73 3a 20 7b 22 7a 77 73 70 22 3a 22 5c 75 32 30 30 62 22 2c 22 6c 69 6e 65 5f 62 72 65 61 6b 22 3a 22 5c 75 30 30 33 63 62 72 5c 75 30 30 33 65 22 2c 22 6f 6e 65 5f 64 6f 74 5f 6c 65 61 64 65 72 22 3a 22 5c 75 32 30 32 34 22 2c 22 6c 72 6d 22 3a 22 5c 75 32 30 30 65 22 2c 22 6e 62 73 70 22 3a 22 26 6e 62 73 70 3b 22 2c 22 72 6c 6d 22 3a 22 5c 75 32 30 30 66 22 7d 2c 0a 62 5f 68 6f 73 74 6e 61 6d 65 20 3a 20 27 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 27 2c 0a 62 5f 72 61 63 6b 72 61 74 65 73 5f 6d 6f 6e 69 74 6f 72 69 6e 67 5f 72 75 6e 6e 69 6e 67 3a 20 74 72 75 65 2c 0a 62 5f 77 69 73 68 6c 69 73 74 5f 72 65 66 65 72 72 65 72 20 3a 20 27 27 2c 0a 62 5f 72 65 67 5f 75 73 65 72 5f 6c 61 73 74 5f 75 73 65 Data Ascii: d6b8tion_tags: {"zwsp":"\u200b","line_break":"\u003cbr\u003e","one_dot_leader":"\u2024","lrm":"\u200e","nbsp":" ","rlm":"\u200f"},b_hostname : 'www.booking.com',b_rackrates_monitoring_running: true,b_wishlist_referrer : '',b_reg_user_last_use
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 62 64 4d 41 50 57 5a 4a 61 65 22 3a 31 2c 22 4e 41 46 4c 65 4f 65 4a 59 54 42 66 45 44 58 61 4e 44 54 51 43 59 4f 22 3a 30 2c 22 54 5a 55 66 43 44 57 4f 4f 44 58 61 4a 50 65 54 4a 4c 42 57 48 5a 48 54 22 3a 30 2c 22 61 58 54 66 48 41 45 44 45 56 48 57 45 63 54 4e 53 56 62 58 51 46 52 57 5a 58 4a 54 5a 55 46 50 54 57 48 54 22 3a 30 2c 22 4e 41 46 4c 65 4f 65 4a 59 54 42 66 45 44 58 66 51 4c 51 42 54 64 51 64 4a 41 49 4f 22 3a 30 2c 22 48 57 41 46 4e 52 59 48 58 54 22 3a 30 2c 22 61 57 51 4f 63 59 54 42 54 4c 45 41 52 57 53 64 55 65 50 54 42 48 65 22 3a 31 2c 22 61 57 51 4d 59 54 42 4e 62 62 57 55 4a 49 46 47 4b 4d 58 44 4f 52 4d 54 66 4c 54 22 3a 30 2c 22 65 57 48 4d 41 45 61 41 4a 44 61 46 42 64 64 51 57 42 65 62 66 46 53 4b 65 22 3a 31 2c 22 4f 41 5a 4f Data Ascii: bdMAPWZJae":1,"NAFLeOeJYTBfEDXaNDTQCYO":0,"TZUfCDWOODXaJPeTJLBWHZHT":0,"aXTfHAEDEVHWEcTNSVbXQFRWZXJTZUFPTWHT":0,"NAFLeOeJYTBfEDXfQLQBTdQdJAIO":0,"HWAFNRYHXT":0,"aWQOcYTBTLEARWSdUePTBHe":1,"aWQMYTBNbbWUJIFGKMXDORMTfLT":0,"eWHMAEaAJDaFBddQWBebfFSKe":1,"OAZO
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 22 4f 44 52 45 47 5a 4e 62 4a 41 45 63 65 45 44 64 45 64 61 57 59 4f 22 3a 31 2c 22 62 51 47 42 62 51 61 53 49 4e 61 63 4d 53 5a 52 4f 62 4f 43 22 3a 31 2c 22 4f 56 59 50 55 51 57 49 62 41 61 4c 46 53 65 62 55 4d 65 46 4c 4f 22 3a 31 2c 22 42 43 64 47 4e 51 62 48 56 45 5a 59 65 4e 62 4e 45 49 49 59 49 45 62 44 62 52 54 22 3a 31 2c 22 63 4a 50 57 5a 4a 45 45 5a 45 42 61 52 49 53 48 54 22 3a 31 2c 22 4e 41 46 51 43 4a 57 5a 55 61 65 5a 65 5a 46 5a 56 42 58 42 48 59 51 65 59 57 65 22 3a 31 2c 22 48 57 41 46 59 4c 4a 56 57 4b 47 64 55 56 59 44 47 44 5a 48 62 57 48 63 63 48 65 22 3a 31 2c 22 4f 4d 54 56 42 45 4e 4e 52 59 58 63 43 48 48 52 48 62 45 4e 48 4b 4b 41 47 56 54 22 3a 31 2c 22 65 57 66 62 57 4e 5a 44 54 5a 55 4c 56 41 54 5a 64 53 47 57 55 43 22 3a 31 Data Ascii: "ODREGZNbJAEceEDdEdaWYO":1,"bQGBbQaSINacMSZRObOC":1,"OVYPUQWIbAaLFSebUMeFLO":1,"BCdGNQbHVEZYeNbNEIIYIEbDbRT":1,"cJPWZJEEZEBaRISHT":1,"NAFQCJWZUaeZeZFZVBXBHYQeYWe":1,"HWAFYLJVWKGdUVYDGDZHbWHccHe":1,"OMTVBENNRYXcCHHRHbENHKKAGVT":1,"eWfbWNZDTZULVATZdSGWUC":1
2024-01-15 23:16:41 UTC	5826	IN	Data Raw: 56 56 44 43 22 3a 31 2c 22 63 43 48 4f 62 58 4b 65 4e 4a 41 62 49 65 57 48 51 57 50 48 44 44 57 65 22 3a 31 2c 22 4e 56 4e 5a 59 65 4a 4d 45 5a 43 50 58 50 52 51 64 44 53 64 41 61 65 22 3a 31 2c 22 4e 41 46 4c 53 52 62 57 4e 50 64 51 42 54 44 65 58 4e 4f 41 56 64 4e 48 57 54 52 54 66 49 5a 4b 65 22 3a 31 2c 22 63 51 5a 4e 44 62 44 41 41 54 50 46 65 5a 4b 55 49 53 59 5a 50 54 42 5a 62 61 54 55 53 47 47 50 54 53 4a 4f 65 58 4b 65 22 3a 31 2c 22 48 4d 62 4d 64 49 58 64 66 64 54 52 56 4b 61 4d 55 50 54 4c 4b 47 42 66 53 43 5a 43 22 3a 31 2c 22 61 58 54 62 53 46 59 54 42 48 4d 48 48 56 62 52 65 49 4e 4c 4f 4c 4f 4c 4f 41 5a 66 4c 64 50 55 56 49 5a 64 52 52 54 22 3a 31 2c 22 48 4d 62 64 44 52 4a 4e 47 50 62 42 66 44 55 49 45 62 66 57 43 55 66 57 4c 45 58 50 42 Data Ascii: VVDC":1,"cCHObXKeNJAbIeWHQWPHDDWe":1,"NVNZYeJMEZCPXPRQdDSdAae":1,"NAFLSRbWNPdQBTDeXNOAVdNHWTRTfIZKe":1,"cQZNDbDAATPFeZKUISYZPTBZbaTUSGGPTSJOeXKe":1,"HMbMdIXdfdTRVKaMUPTLKGBfSCZC":1,"aXTbSFYTBHMHHVbReINLOLOLOAZfLdPUVIZdRRT":1,"HMbdDRJNGPbBfDUIEbfWCUfWLEXPB
2024-01-15 23:16:41 UTC	16384	IN	Data Raw: 37 37 61 66 0d 0a 48 4a 65 61 49 4c 59 4a 4f 22 3a 31 2c 22 65 57 48 4d 48 4d 62 4d 46 4a 51 50 59 64 4e 48 57 4b 41 66 50 49 64 4f 48 63 49 4a 44 65 51 63 4a 55 58 4f 22 3a 31 2c 22 65 44 53 64 55 62 4b 48 51 61 64 54 47 4a 4e 42 64 49 59 42 5a 4a 56 63 54 43 22 3a 31 2c 22 48 57 41 46 59 54 62 44 4f 4c 62 65 54 53 4c 64 61 52 4f 22 3a 31 2c 22 41 45 41 46 5a 64 54 59 4d 49 61 59 66 50 48 5a 56 55 66 43 52 65 22 3a 31 2c 22 49 5a 56 47 48 65 43 58 4c 48 62 56 46 62 58 55 43 65 65 44 4e 51 55 5a 41 52 59 66 59 4f 22 3a 31 2c 22 4f 44 52 45 47 5a 53 49 65 62 63 47 5a 63 56 54 50 4d 56 53 63 66 5a 57 52 43 22 3a 31 2c 22 42 43 56 52 41 41 4f 48 42 64 51 41 55 46 5a 62 53 61 65 22 3a 31 2c 22 63 43 48 4f 62 4d 4b 64 46 45 56 59 51 47 58 55 47 53 63 4f 54 56 Data Ascii: 77afHJeaILYJO":1,"eWHMHMbMFJQPYdNHWKAfPIdOHcIJDeQcJUXO":1,"eDSdUbKHQadTGJNBdIYBZJVcTC":1,"HWAFYTbDOLbeTSLdaRO":1,"AEAFZdTYMIaYfPHZVUfCRe":1,"IZVGHeCXLHbVFbXUCeeDNQUZARYfYO":1,"ODREGZSIebcGZcVTPMVScfZWRC":1,"BCVRAAOHBdQAUFZbSae":1,"cCHObMKdFEVYQGXUGScOTV
2024-01-15 23:16:41 UTC	14263	IN	Data Raw: 52 4f 55 49 48 65 42 41 56 5a 4b 57 65 22 3a 31 2c 22 5a 4e 54 44 56 43 44 64 50 46 43 44 4a 51 61 43 52 62 4e 5a 42 55 62 53 51 41 62 56 45 54 22 3a 31 2c 22 4f 4d 45 49 5a 45 48 62 61 54 61 54 61 42 64 4a 64 48 50 48 46 41 55 41 44 48 53 64 56 58 53 41 43 22 3a 31 2c 22 66 58 47 57 64 55 44 47 4e 4b 4a 58 63 47 42 65 44 64 65 46 43 59 41 4f 49 42 5a 4d 5a 43 22 3a 31 2c 22 66 54 5a 61 54 61 54 61 42 59 4e 5a 53 42 4a 49 52 45 56 53 47 44 4d 53 64 43 22 3a 31 2c 22 59 54 42 4f 51 63 4c 50 51 4c 4d 48 57 61 64 42 4a 4f 54 58 4e 41 55 45 4a 57 63 43 22 3a 31 2c 22 49 5a 56 42 45 48 62 56 46 66 46 65 4e 44 59 54 55 45 54 22 3a 31 2c 22 48 5a 55 61 63 4d 55 49 41 5a 64 4a 41 49 4e 51 5a 51 4e 42 4a 66 42 4d 49 5a 65 62 57 4e 57 65 22 3a 31 2c 22 54 44 58 62 Data Ascii: ROUIHeBAVZKWe":1,"ZNTDVCDdPFCDJQaCRbNZBUbSQAbVET":1,"OMEIZEHbaTaTaBdJdHPHFAUADHSdVXSAC":1,"fXGWdUDGNKJXcGBeDdeFCYAOIBZMZC":1,"fTZaTaTaBYNZSBJIREVSGDMSdC":1,"YTBOQcLPQLMHWadBJOTXNAUEJWcC":1,"IZVBEHbVFfFeNDYTUET":1,"HZUacMUIAZdJAINQZQNBJfBMIZebWNWe":1,"TDXb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.5	50264	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/689588.jpg?k=67d1fdb867d74cdd3a5c6adc2558ff14c165b55329efec5109e5cbea8743aa6c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4615 Connection: close Server: nginx Date: Mon, 01 Jan 2024 13:12:41 GMT ETag: "d6ecda8ac342603fab0d69337a54baa6fe7cca48" Content-Language: 4615 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: xVZ4_X-z_qB_5VS4JKG4P5e1NEkOcN58oyS8A0yByEn9hB3XTfiFBg== Age: 1245839
2024-01-15 23:16:40 UTC	4615	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.5	50267	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	4479	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=25&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=8a4dc4d9-ff21-469d-b3c5-da728db6e3e4&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=1744799861 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VONbFDWKFtMA35PPXw6%2Fk8EAVIA0DqbSc%2FsZDZgNMY%2FEXhPnNd%2F7iZOYrPGiVz8KXfnJxjoM4OG6QsYBCs1OeEVdIaeqa7vdv3peN3QwquZznD0av%2FjhBVSpHULT2ewNEEuGua1tEj9ROcQ0TyVVhuNkb60Fdq5II%3D
2024-01-15 23:16:40 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a2bba3ac437a0126&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjvZRjHwf93OGrTmGV99CEj54oLKMYOO1bQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: GSr-Psxqt8FbfxRGwgtqhO3i6w9CSW3dMzfOpOQZ07MkYGaaPLSFWg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.5	50268	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:40 GMT X-Cache: Error from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: aPHZXvyMs6VmelgsZ-xKjUwOm51jKGX3Dreg_AZz1MG78g8iO2LEcw==
2024-01-15 23:16:40 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.5	50269	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:40 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=350ca3ac9a360116&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssBT18oYef0ytiNSEi3RodDveqI4PNIl5w x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CvO8uTjSjxTW_Pig9FVUw1g9h8pKoFewkdxXjLsS-cE6yBfMBitOCw==
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.5	50270	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 04 Jan 2024 01:23:29 GMT ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: G09s9tEdf9n3cBp6Oa1Ief-uq20An5fmD4N0FE6W99N-Y7YM9WmwsA== Age: 1029191
2024-01-15 23:16:40 UTC	8358	IN	Data Raw: 32 30 39 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 209eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.5	50271	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1950	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360599275&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZwSzBtaUtNQjV1RDkzOTduQ3A3V0JTRGVTeURIVXU5WlpIdUQzb0ZkNXpvcXVCVFA4aDBwb252M0VkdVJZekVPRnNzYTdVOFhVRHEvZmE3TU9qd2dNUW95cU5SY0NYVmVwV09iVTlXYjB6az0mQzBkMjNISWo0UXN4eCs3WnBDekRGVkdBSzZFPQ=="
2024-01-15 23:16:40 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:40 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZtc1h4dW5uTVZxVzFFRCs3eVJETEI1WEw0Ykd3V3YzWnJCQ2drdlY1THlqS0NDL0JCdzh0VU5LLzRDTDRtMHRYNWg5bTlkTmJoY1E5bXdwTkJGblpmN1h5bS9ubk8rVEVtVmF0RjNOekhzcz0mMG1zMzNMMEtySjh2OU90bFZQM3ZtaHBuZS84PQ=="; Expires=Tue, 14 Jan 2025 23:16:40 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1197961237283668 Date: Mon, 15 Jan 2024 23:16:40 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:40 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.5	50274	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:41 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=10a4a3ac8f7f01aa&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGclS9YPd5MxqAED1KHwfc-4TgFJVGmgc1A x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: XKUDmqzCl-_L6UL8Xx5PJGOaNLJVLH1eex7xMmDFOtEgb4xEaKC69w==
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.5	50275	13.32.151.4	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2318	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 1882 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOsi71E01M7sI5kkwBUNhACamyxTR6Rm03NGDvccpS3RN9M9WBwRiIU3ixcUzTo8W6WcbbsA0elSWCGGp%2Fhl2uYgYpSZY5lhgAeOtvxgedcNvXBjvN1Nz55QMbZ803yqWWCvQCfnXPKhEQPElk08YB6%2Bo%3D; lastSeen=1705360600023
2024-01-15 23:16:40 UTC	1882	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 39 37 33 30 31 2d 35 30 39 36 30 35 38 38 35 35 30 36 38 22 2c 22 76 61 6c 75 65 22 3a 38 35 30 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 39 37 33 30 31 2d 31 37 35 37 33 39 36 37 35 35 34 34 30 22 2c 22 76 61 6c 75 65 22 3a 32 35 33 31 2e 38 39 39 39 39 39 39 39 39 39 39 34 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 35 39 37 34 37 38 2d 35 36 34 35 33 32 34 36 39 34 35 33 36 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1705360597301-5096058855068","value":850,"navigationType":"navigate"},"fcp":{"id":"v3-1705360597301-1757396755440","value":2531.899999999994,"navigationType":"navigate"},"cls":{"id":"v3-1705360597478-5645324694536
2024-01-15 23:16:41 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:40 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 9d3d57711186c70df25d455e0890cc8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C2 X-Amz-Cf-Id: U6vL0DYpqkfVV_rq4sbP6-LZa_wDI73GEttVrTA8NO46LNNDlG0GCw==
2024-01-15 23:16:41 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.5	50276	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	2992	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCr8mzIbR%2FKOsi71E01M7sI5kkwBUNhACamyxTR6Rm03NGDvccpS3RN9M9WBwRiIU3ixcUzTo8W6WcbbsA0elSWCGGp%2Fhl2uYgYpSZY5lhgAeOtvxgedcNvXBjvN1Nz55QMbZ803yqWWCvQCfnXPKhEQPElk08YB6%2Bo%3D; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a
2024-01-15 23:16:41 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:40 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=aecda3ac5979046d&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ3Eb8O8NFLAGj4xizi7fouoC41K8_qIRs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: QunN75sYxXw2EgvJHQAPyNvAOSoapxktZKhMPvoGnGsRJUN_6o5rOw==
2024-01-15 23:16:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.5	50272	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 886 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:40 UTC	886	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 64 66 30 33 63 32 31 31 2d 34 64 34 32 2d 34 30 62 30 2d 61 35 36 32 2d 36 36 66 63 64 64 65 36 61 33 38 61 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"df03c211-4d42-40b0-a562-66fcdde6a38a","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","sh":1024,"s
2024-01-15 23:16:41 UTC	388	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.5	50278	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	725	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8483 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:40 UTC	8483	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 65 38 39 35 30 64 66 38 2d 33 38 36 32 2d 34 65 30 32 2d 62 63 61 34 2d 32 34 64 38 37 37 62 34 66 63 33 31 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"e8950df8-3862-4e02-bca4-24d877b4fc31","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","sh":1024,"s
2024-01-15 23:16:41 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 4 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.5	50277	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	790	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_O0wv-8htkv-ARseb33UWk-d3xF53EJOcaQOJvH0r1TdXdMmt&random=2158629236 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.5	50266	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	681	OUT	GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:40 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5571 Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:01:52 GMT ETag: "2daca33e79a04a025f341e9a2b6f4313d5f649c9" Content-Language: 5571 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NgJ55GefSygfK0yut4o3u4asMn-FymvNNTxlfOV3gkBnKwCvl7eedQ== Age: 2114088
2024-01-15 23:16:40 UTC	5571	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.5	50273	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 955 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:40 UTC	955	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 37 30 31 62 62 65 30 35 2d 34 66 33 34 2d 34 65 64 64 2d 38 39 62 37 2d 62 35 32 35 34 61 66 66 61 39 62 33 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"701bbe05-4f34-4edd-89b7-b5254affa9b3","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:41 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:40 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.5	50280	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:40 UTC	1247	OUT	GET /ddm/fls/z/dc_pre=CMf40KXD4IMDFU0IigMdXAMEJQ;src=4228414;type=views;cat=views;ord=5785657291809;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1218470868;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.5	50283	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	451	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 31 Dec 2023 04:28:51 GMT ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: BFNsE7g7PZGT_CDUeoZCUIB-LihXeSGcwt6_dgTSerC96plYi_ZC4A== Age: 1363670
2024-01-15 23:16:41 UTC	8629	IN	Data Raw: 32 31 61 64 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21adJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.5	50282	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	451	OUT	GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 31 Dec 2023 06:03:59 GMT ETag: "118c01722e55044d816db848ac471d09024e4d85" Content-Language: 10601 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d01a0cfc47d6e412dd81c986ff5d69da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: oDo95DYOqb-lCSWfdiRlUXjDMRcrYs1aA6-9BKS38n8aIgfHTA3UxA== Age: 1357962
2024-01-15 23:16:41 UTC	10609	IN	Data Raw: 32 39 36 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2969JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.5	50284	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	451	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 14:48:53 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cA4nR5uVFwEUBau-y8yLbpR5iWXSLNbHwJZW4Ao3rKlIA3XsvCtk8w== Age: 2104068
2024-01-15 23:16:41 UTC	9596	IN	Data Raw: 32 35 37 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2574JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:41 UTC	676	IN	Data Raw: 32 39 64 0d 0a 08 1a f2 ea 35 88 95 c9 c9 2b fd de f9 ae ea 08 d6 38 95 47 40 31 55 14 4b 22 bb b8 8e ce d2 5b 89 4e 12 35 2c df 85 78 ae a9 77 71 a8 ea 13 dd ca 1c 34 8c 4e 37 7d d1 d8 7e 55 da 78 f7 5c 42 cb a5 45 24 58 18 69 c3 12 79 ea 07 1f 9f e5 5c 11 31 67 9f b3 7e 11 b1 ae 98 47 4b 9c 95 67 77 64 42 55 87 73 ff 00 7f 68 08 e7 fb df f7 f2 a4 de 9f de 83 fe fc b5 34 b2 1e 33 6d f8 a3 56 96 32 b8 08 df 3d 1f fe fa a3 63 ff 00 b5 ff 00 7d d2 86 8d 47 fc bb 7f df 0c 7f ad 29 92 33 fc 56 df f7 e9 a8 00 c3 a8 e4 b0 ff 00 b6 d8 a4 08 fc 13 bb fe fe d2 99 53 a6 e8 31 ed 13 52 f9 b1 91 f7 ed ff 00 ef c3 50 17 02 8e 7a 6f fc 25 06 94 23 8e bb c7 fd b5 c5 37 7c 78 fb d6 c7 eb 0b 53 d6 48 c1 fb d6 ff 00 84 0c 68 01 08 1d 0b 27 fc 0a e0 1a 6e d4 ff 00 a6 27 f1 Data Ascii: 29d5+8G@1UK"[N5,xwq4N7}~Ux\BE$Xiy\1g~GKgwdBUsh43mV2=c}G)3VS1RPzo%#7\|xSHh'n'
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.5	50279	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	3680	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1794 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W4pr5w8Bwn9gc2YaU9JhVqFRemYlePujGaqxLdjxKjY%2FCl2fxJOW0gPlw6FqzKsmVVe2gwdTDLgoFXJB5MReygNNY3uNaG9KRjqHknoUXKzgRo9zioNxnZd7rhwsdTDBteexGJeQw25uYAAml6urOavWgXrlbFvHY%3D
2024-01-15 23:16:41 UTC	1794	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 2c 22 64 61 74 65 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 32 30 32 34 2d 30 31 2d 31 35 22 2c 22 63 68 65 63 6b 6f 75 74 22 3a 22 32 30 32 34 2d 30 31 2d 31 36 22 7d 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2,"dates":{"checkin":"2024-01-15","checkout":"2024-01-16"}},"acidCarouselContext":{"acidCarouselId":67}}},"extensions":{},"query":"query AcidCarouselSearch($input:
2024-01-15 23:16:41 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 7506 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:41 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6365a3ac235d0054&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGWiGtlbbkvzbhQV8IKrF64_MD16MiXIqJg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 6lqePFLk09cNq2dRx3P_tS4FOyr9IUwEYkWc7a0SEErGn3HyxJRu-Q==
2024-01-15 23:16:41 UTC	7506	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 61 63 69 64 43 61 72 64 73 22 3a 5b 7b 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 6e 75 6c 6c 2c 22 62 61 73 69 63 50 72 6f 70 65 72 74 79 44 61 74 61 22 3a 7b 22 69 64 22 3a 32 36 30 32 39 35 2c 22 6e 61 6d 65 22 3a 22 41 70 61 72 74 68 6f 74 65 6c 20 53 74 61 72 65 20 4d 69 61 73 74 6f 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 7b 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 70 6c 22 2c 22 63 69 74 79 22 3a 22 4b 72 61 6b c3 b3 77 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 50 6f 6c 61 6e 64 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4c 6f 63 61 74 69 6f 6e 22 7d 2c 22 72 65 76 69 65 77 73 22 3a 7b 22 74 Data Ascii: {"data":{"searchQueries":{"searchAcidCarousel":{"acidCards":[{"landingOptions":null,"basicPropertyData":{"id":260295,"name":"Aparthotel Stare Miasto","location":{"countryCode":"pl","city":"Krakw","country":"Poland","__typename":"Location"},"reviews":{"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.5	50281	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	451	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 16:09:20 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: yfZDB4m86WEeMbacn87DU2tjluVD2NZfTugEsskMdlki3dFINUhRSg== Age: 2099241
2024-01-15 23:16:41 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.5	50285	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	3684	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:41 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 30 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":60}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:41 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 13100 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBIPlip5TcL5rPsGQxqNtYpkXi4orHemZlS1ekzsVIkZyaTSbf9gfBAF80uUPjQX0%2B15USQ6qp1eDtI15QG2W7Jw5Net47%2FQSB1nRUn8DyZt6tFWbLjAaX%2BHflL4swJuXr%2FuO6V9N4tL%2FqxCwAsaCSSudj4UmzJuZo8%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:41 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1a52a3acfd6d02d9&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGQGmh9fY8e17D00QZgqJlitpLeCzwkzYKQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: g3Vo2c8OS46fP7vVte9ebSDYuCXbr3R_LHyBn7DxSHqq712e4BLNSw==
2024-01-15 23:16:41 UTC	13100	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 46 72 6f 6d 20 63 61 73 74 6c 65 73 20 61 6e 64 20 76 69 6c 6c 61 73 20 74 6f 20 62 6f 61 74 73 20 61 6e 64 20 69 67 6c 6f 6f 73 2c 20 77 65 20 68 61 76 65 20 69 74 20 61 6c 6c 22 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 7b 22 70 61 67 65 22 3a 22 50 52 4f 50 45 52 54 59 5f 50 41 47 45 22 2c 22 63 68 69 6c 64 72 65 6e 41 67 65 73 22 3a 5b 5d 2c 22 6e 62 41 64 75 6c 74 73 22 3a 32 Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"__typename":"AcidCarouselOutput","subtitle":"From castles and villas to boats and igloos, we have it all","landingOptions":{"page":"PROPERTY_PAGE","childrenAges":[],"nbAdults":2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.5	50290	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	3440	OUT	GET /js_errors?pid=7ceca3a89c6d001e&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:41 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ea8ba3ac131e0003&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpST6C1jIDNEmd8MD1182bFpyEtkAC77yb x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Wrjt2vc9F0DWksQOuypIRyM1zw_hsjbSjL9yJbCboYu3rVc0CCqy4Q==
2024-01-15 23:16:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.5	50295	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	446	OUT	GET /xdata/images/city/170x136/977066.jpg?k=3659969918f1a86fc601a58056bd1a0f9c1b1e5205cc75e5dd83c5cc6c1ace49&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 8173 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:44:21 GMT ETag: "42cfdf3fa5f0c7a7aabef8ac84d9d6ceb4ff03ff" Content-Language: 8173 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AXaib1KF5lH5rGP0ga5N9-taR2fBIC3-zJguEEd7q6tfz6GjOTi9xg== Age: 1535540
2024-01-15 23:16:41 UTC	6396	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2
2024-01-15 23:16:41 UTC	1777	IN	Data Raw: 92 49 ad 24 79 64 46 91 59 f2 19 ca 80 70 3b 71 d7 a7 19 e9 5e d1 e1 ab 89 6e 34 ff 00 de 60 e3 18 20 e7 eb fc bb 56 54 ab ca 52 e5 91 72 a7 65 73 60 8c 03 44 79 68 d4 9e a4 53 f1 91 49 08 c4 4a 30 4e 06 dc fd 38 ad ee 4d 8e 57 e2 5d b7 da 7e 1f 6a aa 07 2a a8 e3 1d b0 ea 4f e9 9a f1 bf 05 cd 25 bd ee e5 e0 e7 83 b7 83 df fa 7b d7 bf 78 8e d3 fb 43 c2 fa a5 a8 1c cb 69 22 ae 7d 76 9c 7e b8 af 9c 3c 2f 30 8b 52 89 8b b2 8c f2 47 20 fb 11 ff 00 eb fa 57 26 23 53 a7 0e cf a1 3c 41 e1 6b 7d 75 0d cc 57 13 5b 6a 02 1f 2e 2b 88 9c 8c 0c e7 04 02 32 33 5e 3d 05 ae bd 71 6f 14 df 68 55 f3 10 3e 1a ec 82 32 33 cf 15 ef 5a 74 a2 6d 36 d6 40 73 ba 25 3f a5 7c e7 af e9 fa e4 3e 23 d5 22 b6 0f e4 25 dc ab 1e 0f f0 87 38 fd 2b 7b 29 6a 65 19 ca 1a 23 d8 22 f0 24 f1 48 Data Ascii: I$ydFYp;q^n4` VTRres`DyhSIJ0N8MW]~j*O%{xCi"}v~</0RG W&#S<Ak}uW[j.+23^=qohU>23Ztm6@s%?\|>#"%8+{)je#"$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.5	50292	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1511	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360598780 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZtc1h4dW5uTVZxVzFFRCs3eVJETEI1WEw0Ykd3V3YzWnJCQ2drdlY1THlqS0NDL0JCdzh0VU5LLzRDTDRtMHRYNWg5bTlkTmJoY1E5bXdwTkJGblpmN1h5bS9ubk8rVEVtVmF0RjNOekhzcz0mMG1zMzNMMEtySjh2OU90bFZQM3ZtaHBuZS84PQ=="
2024-01-15 23:16:41 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:41 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 2831630962586720 Date: Mon, 15 Jan 2024 23:16:41 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.5	50287	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1073	OUT	GET /pagead/1p-user-list/988382855/?random=1705360597783&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_i197d509oLaI9ZobWyNTHpi9mBZMhBCuj3xzghHEWlEbvJ8N&random=4115807802&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.5	50289	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:41 GMT X-Cache: Error from cloudfront Via: 1.1 0f954bea3b233fb0b6e1981b1e8b6bd8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: DQpx9WFzlqPwfXUmLP3H-m4Et07GPHpK-UO1DjVqMMejnNs9TYnZLA==
2024-01-15 23:16:41 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.5	50294	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	446	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Fri, 22 Dec 2023 11:30:54 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: CAiFW8HZAAbLR48bqBNiQV_XWJqLxsI0SsHE0oYY8cHcedNlSoZMDQ== Age: 2115947
2024-01-15 23:16:41 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.5	50296	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	446	OUT	GET /xdata/images/city/170x136/689588.jpg?k=67d1fdb867d74cdd3a5c6adc2558ff14c165b55329efec5109e5cbea8743aa6c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4615 Connection: close Server: nginx Date: Mon, 01 Jan 2024 13:12:41 GMT ETag: "d6ecda8ac342603fab0d69337a54baa6fe7cca48" Content-Language: 4615 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: UBcAca8sKos2qE7BNgYAyjkwNUuYLePpBR-Jzny32zprCTG3O8ivAQ== Age: 1245840
2024-01-15 23:16:41 UTC	4615	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.5	50288	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1511	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360597923&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_fupSUXTRqaTLl3HIjS40PJucnnu-JQRD_0-RDLxHwytskKyq&random=508482912&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.5	50293	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1071	OUT	GET /pagead/1p-user-list/973712236/?random=1705360597967&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_k3ZKH6DjHbnIcFRKtJhH8uKkOqptOjvw_cfeueeFL7efLagg&random=599786722&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.5	50297	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:41 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=706ea3acfe26015d&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssgF6lwc3BgWABNbFy-ePkbjPyvZfDoYe0 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: G7i6si-2CZdVgG3LikxkflyKJZz_CaFXK9fJB7XqzskNHwe86Mnxpg==
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.5	50300	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	5060	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-AID: 304142 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:41 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 36 25 32 43 33 34 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 31 25 32 43 35 25 32 43 32 37 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 31 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=6%2C34%2C2%2C9%2C7%2C1%2C5%2C27%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=1&has_open_bookings=
2024-01-15 23:16:41 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3XuJDO3IO8J5DdVgWQRh8AxMHpf1biGCGi4qBdhoeTZK2icE8cFTCriBaeTaNwLg8GNpZMWj%2B1nA4YYG6GSynylEDGQ95UkLz2CyIPaQuK6P7egp3TgjdVjdB3yLcPOCBSt7d8DqI8MdemshMKMjqwSMn%2FdsjfUrNU%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:41 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4dfaa3acfd8200bb&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vc9BNbucbf7i8v49RUFc_hYXV6lMZywKmk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: UTpR4p0gikNC6NtzPg7wq7OwhvIivurlvqt16olsuHaSZtZG2dh44Q==
2024-01-15 23:16:41 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.5	50286	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1072	OUT	GET /pagead/1p-user-list/973712236/?random=1705360598000&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0hVuuTBfVjc5kWuiD6e2QNxDfNowOiQySAeWQCJYFtu9LAv9&random=3970838727&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.5	50291	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1072	OUT	GET /pagead/1p-user-list/975716499/?random=1705360598042&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_C6dkLDIEgTr3RTf_2TVnFzs80O94zc7a39hyjaqYJl-D_6MN&random=1991363687&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.5	50298	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:41 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b1b9a3acc9cf0028&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVRthHg4c4gZxbFAb-dP4A516rg83usm5A x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: OHQDouqMM3W73sqWWVMIBJSUgljkk0muC5l0Mco3G_9XyD2fkNXZNA==
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.5	50299	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 86 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	86	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 37 63 65 63 61 33 61 38 39 63 36 64 30 30 31 65 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 34 2e 34 37 30 34 39 39 32 31 36 31 30 36 34 36 34 35 7d Data Ascii: {"pid":"7ceca3a89c6d001e","refAction":"index","siteType":"1","cls":4.4704992161064645}
2024-01-15 23:16:41 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d640ec12547ee097cb75dd5bdc8787b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: 4t1XphwcECrrdh-YH8mw5zBID9pWE0G6rj1CPy5X14LMZetkT5thMg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.5	50301	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	5384	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: EfWlZQAAAAA=O8uaaoEGio0lKViQGvNcXlgSm3LuGAsC_eMZpTPKhBjefCaXYdzzS36SQUqeix88JcBDkjGLxsL7EdADKNRY8UkbVfxKEbcJ5sYtnnEK66dQxc6Y5K5dcu-pGTq_sT-73LPjNPFDDW1DmcU0hVIkgOR5dqCmMIJJBHm_cCgzXfHj1nEv2--67RJQAXYM9SQpfOV3wJM0uptPTjVJ sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALR-ZatBsACAdICJDQ2Y2U4Mjc4LWI2MGUtNDI5NS1hMTU1LTFlODgwYzVkY2FkYdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7ceca3a89c6d001e X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:41 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:41 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4be6a3ac66b503ec&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejK0l1ltWTvzanW32ZLhR1QppBGrk5hECKI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: pyUbM-zjIGs1RKXV-FWHemxLeZIdFBeu_o9M5hEYy9tNgJPtOKcQSw==
2024-01-15 23:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.5	50304	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	1071	OUT	GET /pagead/1p-user-list/975716499/?random=1705360598079&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gGlxjONdeyxb5OSeeKxPtSTDvscDhWgGEq83Cm0-EZsG__B3&random=714141179&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:41 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:41 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.5	50305	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	370	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:41 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d3f0faf13afa-IAD
2024-01-15 23:16:41 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.5	50306	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	446	OUT	GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:41 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5364 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:55:14 GMT ETag: "1e29d071ab764beece3862fd5d8a1fc1fc3f9b64" Content-Language: 5364 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: IAxPhKJqIdjT3l_ZO7FhiheW4gVHx70lMm6AA0eAx3--gCIVstWwMA== Age: 1534887
2024-01-15 23:16:41 UTC	5364	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.5	50307	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:42 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:42 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2d76a3ac9ef100e0&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssU_TB_YzehQN0H6q0a1FmdnWFs4jAr408 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: FDOWxIjqfk9w-1itNEHTVwWR0O0LOtB73lmH2VI4w9n7eRUpsVQqkQ==
2024-01-15 23:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.5	50308	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:41 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:42 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:42 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d6eaa3adf8a40176&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfmFgNK8s3f9_KDGikffcsYWdr_ze1XtvQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: DTMYmeOcxT-P1qhTgTNxXS4XKP1OdvrINK-5EWBiZMw-5KYtYa1Duw==
2024-01-15 23:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.5	50262	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	668	OUT	GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "65adf2d4363bba13d63bbc403b0b3cce" If-Modified-Since: Mon, 15 Jan 2024 13:45:30 GMT
2024-01-15 23:16:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT ETag: "65adf2d4363bba13d63bbc403b0b3cce" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: u3cn6Ed7thVPXGQQa79hHShJJmXcB4zJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Gz2GnK7qr4_nrhkDCmx2kRTUeGZz0YnMBxBl3gjlfURrVL67077P1g== Age: 34272 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.5	50311	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	446	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:42 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 04 Jan 2024 01:23:29 GMT ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 90ad2a23a8617490c9d13e1f260633f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: X5S596XjRClDinlM3ftjQgibEUhymHOKWLg4_G7OzaxKPLJl7ZkPLg== Age: 1029193
2024-01-15 23:16:42 UTC	6398	IN	Data Raw: 31 38 66 36 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 18f6JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:42 UTC	1967	IN	Data Raw: 37 61 38 0d 0a 00 f8 07 47 e0 32 5f 41 94 93 ff 00 2f 0d d8 0e cb 56 35 96 54 f1 56 85 23 64 00 f3 83 ff 00 7c 55 6f 00 95 4d 09 c7 3f eb db f9 0a b3 ac 39 4d 7f 44 62 bf f2 f1 27 5f 42 87 a5 42 5f bf f9 9e 34 5f ee 8c ff 00 12 5b 5c 47 61 f6 a4 da f2 35 ec 6e 8a 41 19 c0 60 a3 9f a8 ad 0b cd 3e 0b bf 08 5d 5b e3 7b bc 72 cf 12 30 e5 5d b2 f8 cf fb d5 af 7f 1c 37 56 7b 41 8d c8 90 36 32 0f 4a 86 08 42 e0 70 2b a1 e8 ee 4a 77 8d 89 f4 4d 2e 18 7c 25 16 95 74 1b c9 68 ca be 09 1c 12 4f 5e d5 e7 1e 2d 86 2b 1f 16 44 2d e4 0d 6a c2 32 b8 6c e0 01 8e 4f fc 06 bd 4e 0d ca 31 b8 1f 72 2b 94 f8 81 a5 24 f6 10 df a8 fd f4 32 28 66 55 fe 13 c7 f3 fa 9a d2 0f 53 29 47 43 ae d6 34 d8 3c 4d a4 4d a7 b5 c4 91 79 83 ef 42 09 3f 9e 2b 8e 4f 85 96 11 61 24 bd 90 80 31 93 Data Ascii: 7a8G2_A/V5TV#d\|UoM?9MDb'_BB_4_[\Ga5nA`>][{r0]7V{A62JBp+JwM.\|%thO^-+D-j2lON1r+$2(fUS)GC4<MMyB?+Oa$1
2024-01-15 23:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.5	50309	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	446	OUT	GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:42 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5571 Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:01:52 GMT ETag: "2daca33e79a04a025f341e9a2b6f4313d5f649c9" Content-Language: 5571 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: XaHmc6M2_utaJGU5sjWzw1SPfMQbhyKLp7nyce8yHVTTpC__dkE3Cg== Age: 2114090
2024-01-15 23:16:42 UTC	5571	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.5	50312	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
2024-01-15 23:16:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Ukxg3naZ6RIMZfHmzISeYJ28SV5gPagG Server: AmazonS3 ETag: "2980ea90c3f4c27d77bffbd1527870a7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: es0LmXMddSNTreL6a5WTQL7kC3nyUiIItHC2gDut63BdySIj0Ntbvg== Age: 79050 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.5	50313	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:42 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1FYxBAlnpir4aMeZTk4ZcxEZA4fQWxaq Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: T_IUeThVdAZJ8ZIeCZDELn1UGcX7kvQ0FsS8jvbxZVfquFOJZFgX3w== Age: 68235 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.5	50310	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	1715	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360599275&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZtc1h4dW5uTVZxVzFFRCs3eVJETEI1WEw0Ykd3V3YzWnJCQ2drdlY1THlqS0NDL0JCdzh0VU5LLzRDTDRtMHRYNWg5bTlkTmJoY1E5bXdwTkJGblpmN1h5bS9ubk8rVEVtVmF0RjNOekhzcz0mMG1zMzNMMEtySjh2OU90bFZQM3ZtaHBuZS84PQ=="
2024-01-15 23:16:42 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:42 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="; Expires=Tue, 14 Jan 2025 23:16:42 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 2661463793965656 Date: Mon, 15 Jan 2024 23:16:42 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:42 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.5	50315	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:42 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HFw3ZCRRGpO5Si5sk_Tu_yxdqq5JBka Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 0FCJj05frNNdrx5BLS6drqqejo74T-xz6gpr6SqrP4837jAFKfy4iQ== Age: 68235 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.5	50314	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
2024-01-15 23:16:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XfMuq.rXaESBqMTX7ruwS5oLJVLV6ApO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9qx478em4aAiaGfP95MsBMnEHEMz-QOSnTbbgnTL3PQmM3t-K-8nLA== Age: 55164 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.5	50316	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "4066f4e0b6c463342177866cfb14bcfe" If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
2024-01-15 23:16:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnArrg..MyhLONitGPttToVO8CuhdWrQ Server: AmazonS3 ETag: "4066f4e0b6c463342177866cfb14bcfe" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: bfrfx3J43c3_to15HrXxIRfq5gfAofaNT9pwLt1nmkT2mICfEQCDaA== Age: 68235 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.5	50317	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:42 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:42 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8134a3add58b021c&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvdT-kMVtPchp_YELlIvWzoFYXjw1aie5o x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: CfFZH0VF-Pd3IGQdoqwvv4Iq5W7nHxLi1b2e9LnQyCBAn-ocjrYQFA==
2024-01-15 23:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.5	50318	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3U6B2Ib0GMmQaf2iQoBKkjUzZ3RXoS92DDNGPiXQLThUWSSFSgePY0c%2FEsykkruAOPRQ9kdo5Xa1GPYswmpVwYcLkzCJm%2FTcIkHvXgPFpXzAkds596k5oHoYztrdyXVVxVVYl78GC8Qr2nWgNN%2FtPERoRzf2Qeu2tI%3D
2024-01-15 23:16:42 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:42 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=675da3ad6d5a00e1&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGSRbWuI7czA9tpf4EhJlOUKfs1826Qj-rA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7f7e359e1c06a914d3d305785359b84c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: FdShk0O-UEd1gBxq6vWy4Y_jOqscw9rB44nBVBqVJup-FxE_e3I5Ig==
2024-01-15 23:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.5	50319	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	676	OUT	GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1fe97ff079513bb667876c67c4aa952f" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:42 GMT ETag: "1fe97ff079513bb667876c67c4aa952f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: fCN4NuuMwamSymkc1hBoNY2dedXX15Np Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d01a0cfc47d6e412dd81c986ff5d69da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WQ-lnDz__lM84Ic-gMWgk-wr2FiUDR7Tc8-xSWqwZtUhSumSFZBLZw== Age: 68235 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.5	50320	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:42 UTC	682	OUT	GET /psb/capla/static/js/client.923775ce.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "a4618794d329c0c74897c7e2128aa1cc" If-Modified-Since: Mon, 15 Jan 2024 08:33:15 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "a4618794d329c0c74897c7e2128aa1cc" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: MWQ8NYyocnzMbPoiKsqG.wjNMqQ87ZuL Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 3EmnPINnjGwZRyNeEkPKsh3BNFlsSKzre1VFrUPo2-Qm_LNd0HcLSw== Age: 52206 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.5	50323	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/7bcb015e.c05167ae.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "3dea702266bc3a577d7141f2e79259db" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "3dea702266bc3a577d7141f2e79259db" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XlrxmKGuatqP44w.p7biLYQQatvO241o Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: k99MKMIQ63P9fmSrf8NUCPiAy7-WPonQ_ox03qkxl8-zMKQ7vZz8gA== Age: 23219 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.5	50322	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:43 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:43 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=341ca3ad99e90294&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGYFSwOARKEC43Ie0sE0vruxVpl8Ir-biFA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 9Mf4wK83qDGcvUFZ0QWqWV1y-n3NwPMYeTAfpLn3H0DkW9EtZ5BVAg==
2024-01-15 23:16:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.5	50324	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "449f8abd0585d68506a1e46ad4a8bbad" If-Modified-Since: Mon, 15 Jan 2024 20:10:57 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "449f8abd0585d68506a1e46ad4a8bbad" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HrQZAFmPje397T7kC9Z_Niv7jdtwFdr Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a2da30f5dacfbd28d77cf4c9702318f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AAtsAEovubNRs-8f1hwPFcC5igqeyhA6QYENIudflpY6zdQIJa-Pcw== Age: 10517 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.5	50325	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/f50a2dfc.cc2f7a1f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "eefe1bd68506ecbaf7afcee3ddccc7e4" If-Modified-Since: Sat, 13 Jan 2024 05:17:05 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: FSpeoflwTC18Opc6yNd_vAzlp6byL2KT Server: AmazonS3 ETag: "eefe1bd68506ecbaf7afcee3ddccc7e4" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: adYg-tqvsd2TBf-lYatCU74I2QYe2CxwFaAvr5ZncRG78128ge57Vw== Age: 27371 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.5	50327	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/d2a738da.b09ae90e.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "b784a10f3e0a67de1f039c5da9307d34" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "b784a10f3e0a67de1f039c5da9307d34" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GcfhqSlQxX6laSWvPSw_OLQhf5iCGLDh Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: i3lwIlFgxBvB2xZIXE4DZK4iuDOsbx6SBu-MMyAVy1977tSv1RBdQw== Age: 23909 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.5	50326	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/1baf5a63.bda1a47c.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "90af4f7d03acdf40d8242f30e2fb0a85" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "90af4f7d03acdf40d8242f30e2fb0a85" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eNb6WNMzTplU2ySq4MjrHGlImCLQ0xwr Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 5UNyb8dXBnUqyqK-u4zu3wzdRTW6qw_5gBb7NfW3SbUJmZzt3r4JeA== Age: 23909 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.5	50321	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:43 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:43 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a60ea3ad6f0104ae&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsthV0YNvDHK-_lDgoBPJyhenZOoiDKDt5w x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: yLcKuAuEd-h1yj6WzyZz_vkY4gXZnlARixU4iFU2r7JilOfmqjPttg==
2024-01-15 23:16:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.5	50328	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	3274	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053606001 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A42+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:43 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:43 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:43 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=03cea3ad22130182&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKznLVpoRoWvCsbk_zZn-YAuAi0ii03Tecr x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 6ioEV-6doEH1TVtY2P9C-SmkaK2B6Y5ZijV4h759hofAOfbTUblqvQ==
2024-01-15 23:16:43 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.5	50329	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/8207c303.bdceabc2.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "a49908dd31f3e4bd429d8384882c9cd8" If-Modified-Since: Fri, 12 Jan 2024 09:30:42 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 8fHsyNxOTixWNLqS0p5QX5MbPJsCcsDz Server: AmazonS3 ETag: "a49908dd31f3e4bd429d8384882c9cd8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a21175361a1e842a337986b5f7399aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: UKXgFtqMTLcfxmBD8A5VkDFl7o61oGKC7HhdF_R_TOB0U2nP7D8L1g== Age: 45976 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.5	50330	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/3d066b0d.fd7d6ddf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8d340c5f9230be5b10b1f59d2a17b65b" If-Modified-Since: Mon, 15 Jan 2024 08:33:14 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "8d340c5f9230be5b10b1f59d2a17b65b" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Pac9I_hNFcXXJu9.GA9ZdW.xHsF0wStl Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: qsmE2SShH4bDLNdhfGkVIAk0gu0gzPQYKQTB0HPRCofcHogbWBg_6g== Age: 52206 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.5	50331	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:43 UTC	690	OUT	GET /psb/capla/static/js/445be7a9.21674fdf.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e8acd113d90ead00a8a9f3cf0530ceca" If-Modified-Since: Mon, 15 Jan 2024 16:23:25 GMT
2024-01-15 23:16:43 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:43 GMT ETag: "e8acd113d90ead00a8a9f3cf0530ceca" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 2JfhWBDNXPlLVY4Y7uHW7GITTlaBSUhU Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 4P0agA4Dk-x6bR9Rv0zMSZ6EkjlHl8kM8FTOs7LwJaL2Ang8F37-KQ== Age: 21734 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.5	50333	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	2779	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:44 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:44 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b5a1a3ae7ae30083&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRR0OQRUv0YFdRJExv-J2Hi03xae63IVaw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: n32TDLJLCoX8Wqjo5BHjgZgwOiYr1Jib8c2uK08buPjIfsurJJ2MIg==
2024-01-15 23:16:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.5	50332	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:44 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:44 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f3a0a3aea9e60079&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsth4aIQNHOqJBw-wBWhkqMDKtyrAvEroyU x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: BadpHiLZrhMPgWK8SKVYmivnUYgjk12G6WCWGLBRj49isyry4uOAbg==
2024-01-15 23:16:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.5	50335	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	3686	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDU5MywiZXhwIjoxNzA1NDQ2OTkzfQ.DNRh9pAV2wksDGDifxHmu8zGCz1f-BsXytqRy2V2l3ljqUyTXGdROvq1WX0JgWT5QgT2DWhAbgpBMsbBHDM6bg x-booking-et-serialized-state: E055-TW_PxfYj_FLGc6nASrx3JN_LVfBVYmmmrAoSktq-tQJLFDFiRsxEsDa0G9Ex x-booking-site-type-id: 1 x-booking-pageview-id: 7ceca3a89c6d001e x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:44 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 35 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":57}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:44 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 204 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:44 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BibV5KAxMKH3HHjktfaM4I6JpiI7EMBuVp0zHzCq2%2F4AxkGATwchistrdnCwbH%2BU1YSuFvEjUjUtrTMQjSNp9aRkiMrM863%2FAC3sbkKbw0O51W0TJwIDZT9g%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:44 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7493a3ae14e702ae&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGR11uyTXHCWnoRd_yai__RxsfVhbQzY2UA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: z0AW7jeNU3uG_V_j7AjPN-sHfdusLIy4Woj4ZTsA_vBMVmLC807ncw==
2024-01-15 23:16:44 UTC	204	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 61 63 69 64 43 61 72 64 73 22 3a 5b 5d 2c 22 73 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 68 61 73 41 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 66 61 6c 73 65 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 7d 7d 7d Data Ascii: {"data":{"searchQueries":{"searchAcidCarousel":{"landingOptions":null,"title":null,"__typename":"AcidCarouselOutput","acidCards":[],"subtitle":null,"hasAvailability":false},"__typename":"SearchQueries"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.5	50337	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	4231	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 2125 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577
2024-01-15 23:16:44 UTC	2125	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEogg
2024-01-15 23:16:45 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 91 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:45 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9fc2a3aedffd016d&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvFtaD3EIxGYnnPT8RZ_CD7__RuCxY82yc x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: JHkA2KDmmiuRUmVV0UVtLYMShOT8O_tx7nGziKVfaFxdeFqC2gU08g==
2024-01-15 23:16:45 UTC	91	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.5	50336	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	4486	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2 X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:45 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=40d0a3aea7730057&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL3nTtTAkYp9t6X5py4O3URxGqhF_XKBIY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Q_9vYS7y3YuTSPpkTMwEa6I0HN72-LRYLl-v9w3CAUsOEVL0oDVdSA==
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.5	50341	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAlFqiKxwpAAAA:oC7MbWXVlemTWGAUznA6qUIYh525qNcaFsWrgMk/I7hSO7rE8rZg/+Uvqr+d8ICbMts+APckrVg8h6i2cGPPWoMWarXFk8RYiRZFtoMJTmfjuVkDyeCKdrmuofoD8qYW2Mvx2FCTRhyuVkE20uBVO9RPOvGM3fcN7BptdPc+PHeEHqFMYhRh4HGEDuzdAjQutSKxtEyhncJ69uWYEJ5UXfkTzcyMj8h0yOrew/7mOjFUgpRwwipOyp/OcYOatK6tGY1rGGgl; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT9n7bkWNr4EurgDEfDW1sdHIeipP0c5mbKkp3UyIVzUqnMEwwEsDkOSfkgWHuSNamvhl5qCkv4upGD88sUEIt8sI1H0JuaJHz3%2FvN049qdcnpvh7%2Fb0Cq3OS0HCtvqqf9O9PbJTpm0%2Fk%3D
2024-01-15 23:16:45 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bf32a3ae8fab054d&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvXs-ysgo8PxAUvMgL8nhAAbVHaoe9Q6ek x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: DG-r3sIbBzTxLGDnVhhyXlm3OEH6X_B0hEwrpsneepaNB9DRD79DBw==
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.5	50339	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	637	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-Modified-Since: Mon, 15 Jan 2024 23:16:18 +0000
2024-01-15 23:16:45 UTC	520	IN	HTTP/1.1 304 Not Modified Content-Type: text/javascript Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:44 GMT cache-control: private, max-age=86400 last-modified: Mon, 15 Jan 2024 23:16:18 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcdc-43650cae1d7305346edf077b X-Cache: Miss from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ybYSB9MAjlNln__m2fwTXVayw8XI25PsdgFpyZAaAYUFsWnw6eFuMw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.5	50340	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:44 UTC	2787	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W4pr5w8Bwn9gc2YaU9JhVqFRemYlePujGaqxLdjxKjY%2FCl2fxJOW0gPlw6FqzKsmVVe2gwdTDLgoFXJB5MReygNNY3uNaG9KRjqHknoUXKzgRo9zioNxnZd7rhwsdTDBteexGJeQw25uYAAml6urOavWgXrlbFvHY%3D
2024-01-15 23:16:45 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d376a3aeb3370062&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGY8mBj1boJKFym1wBYN0jwhtGI7WZOlhTw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 55b6418a8a2f714a67d8e4d292154ef2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: yMoo0EGJZ5f9I5znSV-nEOHr32z3hccgbXCgOr67QIQ60gspzTpq0A==
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.5	50342	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:45 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-headers: x-booking-et-serialized-state strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 0fd782cbc1c3c43778f2ac89b2bfb444.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: HZRYvHEJiVoPgYpXHff5B3RCv6Iydgsczr7PTTzGMxpmuQS24wJV2Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.5	50343	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Fri, 12 Jan 2024 16:20:06 GMT
2024-01-15 23:16:45 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Ukxg3naZ6RIMZfHmzISeYJ28SV5gPagG Server: AmazonS3 ETag: "2980ea90c3f4c27d77bffbd1527870a7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: GbmMFycUxbWouMTSOoktnZ9cPtW-y1KrXhlCV7uYX7fy0XXu2kqJfA== Age: 79053 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.5	50344	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:45 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1FYxBAlnpir4aMeZTk4ZcxEZA4fQWxaq Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d5710f445906ae917df909d01c495c9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: fWeTVGf1C8FPIR882TNYHrmE-Es4uaHqeOgCwKM2D3ixsFRlqNMw3A== Age: 68238 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.5	50348	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:45 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1HFw3ZCRRGpO5Si5sk_Tu_yxdqq5JBka Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: wnPO7zNv1U9yjO2eM5Kyt33zWUswpakbcjr8rRR0DOv42D0Sii9VOQ== Age: 68238 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.5	50345	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Mon, 15 Jan 2024 05:18:08 GMT
2024-01-15 23:16:45 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XfMuq.rXaESBqMTX7ruwS5oLJVLV6ApO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 1I7TXM47cSAajVLvdjjzsYbVGLX3si94hroWW7P0cWceVO8J4b0LVw== Age: 55167 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.5	50346	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/8207c303.462834bc.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "4066f4e0b6c463342177866cfb14bcfe" If-Modified-Since: Sat, 13 Jan 2024 05:17:04 GMT
2024-01-15 23:16:45 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lnArrg..MyhLONitGPttToVO8CuhdWrQ Server: AmazonS3 ETag: "4066f4e0b6c463342177866cfb14bcfe" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: FluUySjXN2QFyZ9Dk6CSgCiupow6_MldbphzNfQDp-g4C9JlAQsW0g== Age: 68238 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.5	50347	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	676	OUT	GET /psb/capla/static/css/3d066b0d.e1874fca.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1fe97ff079513bb667876c67c4aa952f" If-Modified-Since: Sun, 14 Jan 2024 05:17:32 GMT
2024-01-15 23:16:45 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:16:45 GMT ETag: "1fe97ff079513bb667876c67c4aa952f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: fCN4NuuMwamSymkc1hBoNY2dedXX15Np Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 429NPSXDsY4c4EGuWBBOfrUrYCsA4-mU-PAUWmSq5QUBSrafVNv6Bw== Age: 68238 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.5	50334	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	1231	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 8094 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=3khr2lf4oy09 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZVn7EZBERoyxNrl56K88R0RlaOWLilhTujNyg1Kpvy8kTBuUIJ52GloQ0gWh5JBCk7d00WOoq7ICSIGNOI; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:45 UTC	8094	OUT	Data Raw: 0a 18 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 12 a4 0f 30 33 41 46 63 57 65 41 34 42 43 4e 5a 65 5a 74 45 59 70 35 69 4f 70 55 4f 32 77 35 6d 6b 54 76 61 4d 70 4d 48 4f 36 70 56 5a 59 57 5f 74 70 6c 72 35 39 77 6a 44 58 6d 4f 48 63 6c 65 4e 59 61 37 44 48 74 69 79 4a 5f 5a 71 66 48 34 35 43 5f 47 59 68 47 41 48 6b 62 4c 6d 33 62 59 55 55 46 4a 4c 6c 64 52 76 68 44 7a 51 6f 72 6f 64 76 6c 6b 4d 52 65 76 71 35 2d 76 66 63 48 63 4f 33 54 47 6f 4e 58 66 2d 66 56 4f 31 6b 47 4f 66 76 54 6e 64 59 71 35 6d 4d 74 72 34 68 44 6c 74 70 35 6d 4e 4b 36 41 6e 57 76 45 55 38 53 47 30 64 6a 73 43 34 38 6a 58 65 4c 7a 38 6e 48 38 50 59 47 67 4e 62 74 57 46 73 4e 69 7a 6d 75 70 6a 78 6b 67 6f 53 4f 41 2d 67 64 59 61 39 4c 50 76 78 30 4a 62 Data Ascii: u-xcq3POCWFlCr3x8_IPxgPu03AFcWeA4BCNZeZtEYp5iOpUO2w5mkTvaMpMHO6pVZYW_tplr59wjDXmOHcleNYa7DHtiyJ_ZqfH45C_GYhGAHkbLm3bYUUFJLldRvhDzQorodvlkMRevq5-vfcHcO3TGoNXf-fVO1kGOfvTndYq5mMtr4hDltp5mNK6AnWvEU8SG0djsC48jXeLz8nH8PYGgNbtWFsNizmupjxkgoSOA-gdYa9LPvx0Jb
2024-01-15 23:16:45 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 15 Jan 2024 23:16:45 GMT Expires: Mon, 15 Jan 2024 23:16:45 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww;Path=/recaptcha;Expires=Sat, 13-Jul-2024 23:16:45 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:45 UTC	556	IN	Data Raw: 61 37 66 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 30 45 68 35 65 65 61 68 45 6c 4f 31 31 4c 63 65 58 74 77 6d 6e 58 36 6a 52 43 54 46 57 30 57 55 72 4a 42 42 74 6a 6d 78 49 77 48 61 46 35 2d 46 2d 5f 42 31 52 75 30 34 6f 42 39 74 33 68 6f 66 6a 46 54 41 4b 34 68 42 44 61 4e 59 34 41 63 4b 6f 6b 57 71 72 64 52 78 61 53 41 54 68 48 69 6c 73 5f 79 31 2d 75 76 2d 69 77 4d 33 44 74 6e 36 58 57 34 58 6e 47 67 39 53 61 2d 39 75 44 30 58 45 62 43 53 66 37 49 4a 63 44 6f 57 52 44 5f 59 37 56 71 2d 47 65 73 48 44 4f 6d 77 70 36 37 68 56 6f 44 34 4e 44 33 63 75 71 47 78 6e 6c 68 30 4b 67 67 76 61 4f 7a 76 4c 70 58 44 62 38 2d 70 4c 4b 57 58 4e 73 5a 49 6b 56 71 6f 6a 4a 35 74 6d 6e 6a 65 30 53 70 72 76 6a 51 67 59 39 6c 41 4d 75 Data Ascii: a7f)]}'["rresp","03AFcWeA60Eh5eeahElO11LceXtwmnX6jRCTFW0WUrJBBtjmxIwHaF5-F-_B1Ru04oB9t3hofjFTAK4hBDaNY4AcKokWqrdRxaSAThHils_y1-uv-iwM3Dtn6XW4XnGg9Sa-9uD0XEbCSf7IJcDoWRD_Y7Vq-GesHDOmwp67hVoD4ND3cuqGxnlh0KggvaOzvLpXDb8-pLKWXNsZIkVqojJ5tmnje0SprvjQgY9lAMu
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 78 30 59 53 35 46 53 4d 50 53 47 6d 6d 72 39 64 6b 41 72 76 72 6f 46 77 57 34 55 68 6d 39 59 47 55 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 22 2c 22 22 2c 22 59 31 6c 43 64 54 56 4c 62 6b 6b 31 4e 33 46 4d 52 6a 64 42 65 54 6c 48 4f 55 4e 42 65 58 70 4f 57 57 70 36 51 32 73 77 4d 69 73 7a 57 58 64 57 54 47 5a 4d 57 56 59 31 54 46 56 45 5a 46 4a 68 61 46 70 68 53 48 55 31 59 31 52 32 65 6e 6c 74 4e 6c 52 72 59 30 4e Data Ascii: x0YS5FSMPSGmmr9dkArvroFwW4Uhm9YGU",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz","","Y1lCdTVLbkk1N3FMRjdBeTlHOUNBeXpOWWp6Q2swMiszWXdWTGZMWVY1TFVEZFJhaFphSHU1Y1R2enltNlRrY0N
2024-01-15 23:16:45 UTC	886	IN	Data Raw: 4e 32 56 58 51 32 45 31 4e 30 56 6d 53 30 46 57 54 30 74 61 51 31 49 7a 51 30 46 34 4d 56 5a 70 4e 45 45 72 54 6b 67 35 61 32 31 61 5a 56 56 50 4c 32 31 46 53 56 45 78 4e 6d 35 75 65 57 77 72 59 6a 64 6c 53 55 51 77 64 6b 78 72 57 6e 42 72 52 56 46 6b 61 48 52 44 54 48 51 77 62 6c 42 5a 57 46 46 77 64 6b 74 71 52 55 39 61 51 31 70 43 51 6a 4e 73 64 47 46 50 55 33 49 76 61 7a 6c 74 5a 32 70 34 65 57 52 72 5a 46 70 55 59 32 4d 78 51 6c 68 50 4e 45 6c 4d 4f 57 78 77 57 6d 5a 48 4e 45 4a 33 4e 57 46 77 4d 6d 52 61 4d 6b 68 58 64 48 41 30 62 47 6c 49 51 57 68 46 61 30 39 42 61 54 64 73 5a 6a 4e 52 54 48 5a 55 63 6a 5a 6c 53 32 4d 35 51 33 64 73 54 57 46 7a 61 46 46 42 4e 44 4e 4a 54 6a 52 55 53 31 56 52 57 6b 64 45 54 56 56 4d 65 45 5a 5a 55 31 63 78 4e 32 31 Data Ascii: N2VXQ2E1N0VmS0FWT0taQ1IzQ0F4MVZpNEErTkg5a21aZVVPL21FSVExNm5ueWwrYjdlSUQwdkxrWnBrRVFkaHRDTHQwblBZWFFwdktqRU9aQ1pCQjNsdGFPU3IvazltZ2p4eWRrZFpUY2MxQlhPNElMOWxwWmZHNEJ3NWFwMmRaMkhXdHA0bGlIQWhFa09BaTdsZjNRTHZUcjZlS2M5Q3dsTWFzaFFBNDNJTjRUS1VRWkdETVVMeEZZU1cxN21
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 31 36 36 35 0d 0a 5a 33 4a 68 64 31 6f 76 57 44 64 46 62 55 6b 35 5a 7a 56 6e 5a 47 49 30 53 6b 5a 58 64 55 35 36 5a 57 74 6a 55 31 4e 35 53 6b 55 77 51 55 74 4c 5a 31 68 4f 53 55 5a 49 53 58 52 71 63 47 5a 71 53 47 39 59 56 56 64 4b 56 57 4a 35 63 6b 64 32 59 32 4a 36 53 47 31 4a 62 57 35 75 56 55 56 77 51 7a 4d 79 53 31 68 33 57 48 70 4e 61 30 4a 6a 64 32 56 4e 4f 48 41 31 65 55 31 44 59 6d 74 34 64 7a 64 46 52 43 39 72 4e 48 4e 52 56 58 6c 4c 55 33 56 45 5a 46 46 42 61 6b 64 43 4b 31 4a 4c 52 32 6b 33 5a 53 38 7a 61 58 64 77 64 30 51 34 5a 44 49 72 4c 32 56 49 52 55 35 73 4f 48 68 71 65 6d 5a 4e 4e 56 42 6d 54 55 46 79 53 43 39 4d 65 47 52 32 62 58 4a 4f 64 6d 38 31 51 6b 64 68 53 58 68 58 52 6c 46 78 59 6c 68 32 57 44 4a 6d 5a 46 46 36 65 6c 49 77 55 Data Ascii: 1665Z3Jhd1ovWDdFbUk5ZzVnZGI0SkZXdU56ZWtjU1N5SkUwQUtLZ1hOSUZISXRqcGZqSG9YVVdKVWJ5ckd2Y2J6SG1JbW5uVUVwQzMyS1h3WHpNa0Jjd2VNOHA1eU1DYmt4dzdFRC9rNHNRVXlLU3VEZFFBakdCK1JLR2k3ZS8zaXdwd0Q4ZDIrL2VIRU5sOHhqemZNNVBmTUFySC9MeGR2bXJOdm81QkdhSXhXRlFxYlh2WDJmZFF6elIwU
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 39 78 57 6d 70 6b 53 31 46 54 52 30 70 4a 57 6a 4d 7a 65 46 4e 70 61 54 46 77 63 44 52 57 4e 45 46 69 65 47 5a 6b 64 6d 68 68 55 55 4a 30 65 57 4e 71 52 31 6c 6d 57 43 74 55 54 48 4e 55 56 55 56 52 51 6d 52 68 57 6d 30 33 61 57 31 61 65 55 74 50 52 30 6b 78 56 6d 64 4c 4b 33 42 34 5a 58 4e 72 57 57 70 49 63 58 52 4b 54 6b 31 34 62 46 41 30 5a 48 56 59 53 55 6c 4f 57 46 42 4e 63 55 78 71 64 55 45 30 4e 6e 67 78 56 30 5a 71 61 48 42 46 54 6e 5a 42 63 6c 56 53 54 31 52 5a 55 56 49 79 4d 6d 49 35 4d 55 49 30 5a 54 56 46 54 54 64 54 64 7a 6c 55 4d 57 55 76 4f 57 51 7a 4e 46 67 32 56 48 52 79 57 48 6c 6c 4d 6d 74 52 51 33 70 46 54 44 4a 6f 64 57 4a 6f 63 32 68 68 51 55 4e 68 63 31 4e 6d 56 48 6c 68 55 6d 38 76 55 46 46 6c 54 58 52 70 62 6d 4e 71 5a 33 42 58 4e Data Ascii: 9xWmpkS1FTR0pJWjMzeFNpaTFwcDRWNEFieGZkdmhhUUJ0eWNqR1lmWCtUTHNUVUVRQmRhWm03aW1aeUtPR0kxVmdLK3B4ZXNrWWpIcXRKTk14bFA0ZHVYSUlOWFBNcUxqdUE0NngxV0ZqaHBFTnZBclVST1RZUVIyMmI5MUI0ZTVFTTdTdzlUMWUvOWQzNFg2VHRyWHllMmtRQ3pFTDJodWJoc2hhQUNhc1NmVHlhUm8vUFFlTXRpbmNqZ3BXN
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 4a 58 64 46 5a 45 54 6b 74 7a 62 46 42 68 56 58 64 71 55 6b 4e 56 59 6d 64 47 62 33 52 45 57 57 5a 77 4d 30 6f 79 59 55 4a 51 4c 32 6c 4f 64 45 4a 34 5a 47 64 51 63 44 46 4a 64 55 34 35 62 56 4d 77 62 58 4a 6a 61 32 5a 78 65 45 35 75 64 56 56 48 4e 44 5a 6c 52 46 64 72 62 47 49 30 4d 56 70 4c 4e 48 68 75 4c 30 45 32 61 45 55 76 4b 33 68 4f 61 45 46 6f 4e 58 42 78 5a 58 5a 43 54 55 56 51 64 54 4a 68 64 30 78 6c 4f 47 78 56 51 30 56 31 63 44 56 56 4d 32 64 32 55 30 4e 6d 4b 32 31 48 4e 6c 4e 4c 57 46 4a 5a 4b 7a 46 58 62 6b 46 4d 62 48 55 33 52 32 34 34 63 6b 56 36 4d 44 64 6d 54 33 64 61 4f 45 4e 57 52 69 73 76 65 6c 56 73 4c 31 6b 33 51 31 70 45 54 57 35 78 61 6a 46 54 59 55 74 79 54 55 45 78 4f 46 6c 51 54 58 64 78 54 6d 31 34 52 6c 51 79 61 55 77 79 4f Data Ascii: JXdFZETktzbFBhVXdqUkNVYmdGb3REWWZwM0oyYUJQL2lOdEJ4ZGdQcDFJdU45bVMwbXJja2ZxeE5udVVHNDZlRFdrbGI0MVpLNHhuL0E2aEUvK3hOaEFoNXBxZXZCTUVQdTJhd0xlOGxVQ0V1cDVVM2d2U0NmK21HNlNLWFJZKzFXbkFMbHU3R244ckV6MDdmT3daOENWRisvelVsL1k3Q1pETW5xajFTYUtyTUExOFlQTXdxTm14RlQyaUwyO
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 51 77 53 57 78 35 52 55 35 51 57 58 42 58 59 6a 64 45 52 30 45 79 51 7a 6c 71 51 54 56 33 54 6a 46 75 63 6b 78 31 4c 31 5a 76 53 32 64 33 51 7a 68 56 4d 6e 49 79 62 55 68 74 5a 6a 4a 4b 54 30 56 32 4e 7a 4e 78 52 33 5a 4f 51 7a 6c 6a 4f 55 6c 56 56 48 4d 31 54 69 74 79 52 56 68 48 4e 47 4e 55 4f 56 70 4f 51 32 4e 4c 55 54 68 7a 4e 32 38 7a 64 58 56 6d 61 7a 56 42 54 6b 52 76 61 6d 31 7a 4e 46 70 35 4f 55 77 31 54 57 52 68 55 32 35 6f 53 48 70 6f 59 33 70 73 4c 30 52 6a 53 55 5a 36 4d 45 52 69 4d 58 56 53 4f 44 5a 36 4d 6c 4e 68 4d 47 35 6d 57 55 31 53 52 30 6c 72 55 6e 70 30 51 6b 38 78 65 6b 70 34 53 31 68 4c 62 48 51 32 53 45 56 52 52 30 64 4c 4b 30 6c 61 63 47 46 4d 52 47 31 75 55 6b 31 42 63 6b 78 42 56 45 39 4a 51 30 38 7a 59 55 38 77 54 33 55 31 62 Data Ascii: QwSWx5RU5QWXBXYjdER0EyQzlqQTV3TjFuckx1L1ZvS2d3QzhVMnIybUhtZjJKT0V2NzNxR3ZOQzljOUlVVHM1TityRVhHNGNUOVpOQ2NLUThzN28zdXVmazVBTkRvam1zNFp5OUw1TWRhU25oSHpoY3psL0RjSUZ6MERiMXVSODZ6MlNhMG5mWU1SR0lrUnp0Qk8xekp4S1hLbHQ2SEVRR0dLK0lacGFMRG1uUk1BckxBVE9JQ08zYU8wT3U1b
2024-01-15 23:16:45 UTC	733	IN	Data Raw: 6c 59 65 55 74 31 62 45 78 6b 65 46 4e 48 61 32 6b 33 56 30 35 43 61 55 78 75 56 6e 46 6a 4e 56 6c 55 5a 33 68 5a 57 6a 67 77 51 6b 67 34 65 58 5a 46 56 30 34 78 59 30 31 33 59 6c 4d 76 4d 7a 56 5a 5a 6b 70 44 65 6d 56 6c 64 32 78 53 59 6a 68 78 54 58 4d 34 4d 31 42 57 53 32 56 31 62 45 52 34 64 6a 52 5a 62 48 4a 54 54 32 52 4f 62 58 64 4a 55 6d 64 51 4d 55 78 4c 4d 33 56 30 57 44 51 31 52 58 42 48 61 30 31 71 65 58 42 76 59 6c 56 68 4e 30 30 31 61 31 68 47 62 30 4a 74 64 6a 68 4c 62 6b 56 4a 53 58 6c 43 61 30 31 34 53 48 4d 33 4e 58 6c 78 59 6e 4a 70 56 33 42 78 4f 58 4a 70 4e 58 45 33 62 56 64 4a 62 33 4e 4a 53 56 42 72 55 31 52 49 63 57 5a 36 65 6d 78 30 63 6b 34 72 53 6d 52 77 55 30 52 46 59 55 68 6b 5a 57 78 4a 62 30 4a 4e 56 6e 70 7a 57 54 68 4c 51 Data Ascii: lYeUt1bExkeFNHa2k3V05CaUxuVnFjNVlUZ3hZWjgwQkg4eXZFV04xY013YlMvMzVZZkpDemVld2xSYjhxTXM4M1BWS2V1bER4djRZbHJTT2RObXdJUmdQMUxLM3V0WDQ1RXBHa01qeXBvYlVhN001a1hGb0JtdjhLbkVJSXlCa014SHM3NXlxYnJpV3BxOXJpNXE3bVdJb3NJSVBrU1RIcWZ6emx0ck4rSmRwU0RFYUhkZWxJb0JNVnpzWThLQ
2024-01-15 23:16:45 UTC	1252	IN	Data Raw: 31 32 36 64 0d 0a 6b 52 30 5a 6c 42 50 57 6b 4a 52 55 6b 77 35 4c 7a 68 73 54 30 68 32 4f 46 5a 57 64 6d 68 4a 57 58 45 34 4e 57 4a 4b 55 30 46 45 56 6c 68 52 52 48 68 56 54 47 31 6b 4f 48 6c 79 64 6a 4a 53 54 57 52 51 64 6b 39 56 52 30 4e 42 63 54 68 48 64 6b 74 35 5a 44 52 35 4e 48 46 51 62 79 39 4b 54 47 74 30 61 47 56 34 55 55 31 79 56 56 45 32 62 31 70 55 4d 6e 51 34 4d 56 46 33 4c 32 52 68 4d 30 68 6d 53 55 6b 31 57 45 70 36 63 46 4a 48 61 32 52 36 64 7a 67 34 4d 46 4a 43 64 6a 56 6e 61 6b 4a 52 61 54 46 72 65 55 46 35 4d 43 74 42 64 6a 42 30 4e 6a 4a 4c 62 6b 70 31 65 46 41 78 65 6e 46 56 55 54 6c 5a 53 6e 70 6e 4f 54 5a 74 4e 6e 4d 72 4d 44 68 42 64 43 38 78 4f 58 4d 35 59 31 42 6a 4e 6a 64 4a 64 57 6c 75 4d 46 4e 59 53 6d 70 5a 61 7a 4e 6d 4d 6d Data Ascii: 126dkR0ZlBPWkJRUkw5LzhsT0h2OFZWdmhJWXE4NWJKU0FEVlhRRHhVTG1kOHlydjJSTWRQdk9VR0NBcThHdkt5ZDR5NHFQby9KTGt0aGV4UU1yVVE2b1pUMnQ4MVF3L2RhM0hmSUk1WEp6cFJHa2R6dzg4MFJCdjVnakJRaTFreUF5MCtBdjB0NjJLbkp1eFAxenFVUTlZSnpnOTZtNnMrMDhBdC8xOXM5Y1BjNjdJdWluMFNYSmpZazNmMm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.5	50350	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	2791	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:45 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0615a3aefe6a033b&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGQKl70s-AyLnxMI8N7Z1n35l9jdiFdsRwA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: aOQsWgaBAYzRpQgOLvz8mIe7TVdvaoGIA4zpTeSIn4xYZAn3a41uxg==
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.5	50349	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	4568	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BibV5KAxMKH3HHjktfaM4I6JpiI7EMBuVp0zHzCq2%2F4AxkGATwchistrdnCwbH%2BU1YSuFvEjUjUtrTMQjSNp9aRkiMrM863%2FAC3sbkKbw0O51W0TJwIDZT9g%3D
2024-01-15 23:16:45 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6669a3ae486f010f&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejILMGIqQJslGULctsGIr4QlLgUm352FwLk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: FOVP8rrp7fjn-j2rOeQa5HlF1U3OoVoYcNxyiqjU6UTtQ8SLoNJD2A==
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.5	50351	108.138.85.78	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	2449	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
2024-01-15 23:16:45 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:45 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 98b2021a1a69853671ec2390cb8757f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: YURqkBQgj6tFFCCeRXgI1NajsqVoynDYm9MuoC6maQpwTUFliVtSNg==
2024-01-15 23:16:45 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.5	50353	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:45 UTC	2066	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
2024-01-15 23:16:46 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:46 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 030b88b6d8d9c6faf056723bb5f16078.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: SXPMePKoP2iA3hcCn_KQyNe7wM-GwYZhNvcQglNPHa969gZoC4yf9g==
2024-01-15 23:16:46 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.5	50354	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:46 UTC	3271	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ver=2&stype=1&lang=en-us&ref_action=index&aid=304142&pid=7ceca3a89c6d001e&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YQBb8MEnxMVi1xnOVR89YEL8CrqRF0pD_u05LgrKrQJSw7BN3oJlCF4E8DfVAkW5ZAiQcOobShnvpaYV74Xt5C5HGDVMin-NehRmJ7W3mjeZiDRCmFEeFqDfabBPVnPujWrq2q9yhX-kktQ8zhym6Gg_EeL5YnWnMMTCgTokf8XKK0MmRExnXAxVqjp_gBQ33Nypu5TRg2ITfwzz0RjqEjxwasZMrR3u2OHgzJcvV1W-H7-pdfvjm40Uvm3jd6ppoWCt5dUg38SH0dpmpBd8G7n9lC8ThUY8U0TettSemji6 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
2024-01-15 23:16:47 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0ec6a3afbedf0395&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIMyskxWkVnvLmh7Rf-ccd_z2Lkou0x5xM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 4Y6wLPl54r9ujVe-MpUbSXNLTV05sx3DQJm-WFSo76lCh_DuP7NyIA==
2024-01-15 23:16:47 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.5	50352	172.253.63.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:46 UTC	1757	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je41a0v888381215z879615461&_p=1705360596915&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2F&sid=1705360585&sct=1&seg=1&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2F&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&epn.cd_logged_in=0&ep.cd_tsmp=1705360597303&ep.cd_user_location=us&ep.cd_site_section=Stays&up.up_ga_client_id=810723182.1705360577&upn.up_is_subscribed_to_newsletter=0&tfd=12472 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:47 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Mon, 15 Jan 2024 23:16:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.5	50356	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 86 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	86	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 33 30 30 36 2e 36 39 39 39 39 39 39 39 39 39 38 32 35 7d Data Ascii: {"pid":"f667a3ac68470510","refAction":"index","siteType":"1","lcp":3006.6999999999825}
2024-01-15 23:16:47 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 bc330e83c319e99d19922ed79166586a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: FqPF4PuOedwOE0auatP_MaP41DGr00TZDos5VWpBUKW3adMaJb_CGw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.5	50357	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	4539	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3006&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e050a3af898a0259&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKKxnE2SXdit-OECDZuBPNhDE2VW9s1xpM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: sR4rssjuFwRvqEn-D84lknYq59QVec-ABzW3-SI_S7n-OJqlqPcvkA==
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.5	50355	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 1814 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	1814	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 72 73 2b 69 67 2b 6f 63 41 41 41 41 3a 58 48 37 33 55 43 45 64 4d 75 72 5a 30 76 49 64 79 75 73 31 74 4e 79 35 76 76 37 77 2f 6b 67 6a 39 74 4f 4f 7a 34 72 4e 47 38 4d 66 7a 79 44 34 58 4c 74 30 45 32 49 50 45 4d 61 75 79 2b 32 57 2b 59 6b 2f 34 34 75 43 65 4a 63 6b 6c 4f 31 79 30 6f 43 50 69 78 31 2f 64 77 58 35 51 7a 47 54 43 6a 45 2f 45 48 55 30 39 4d 45 4d 6d 32 65 2b 47 51 69 6b 4c 39 5a 66 36 64 4f 75 46 4f 32 51 6d 70 39 68 37 70 7a 72 43 6e 37 64 68 6b 57 42 7a 6c 67 39 6d 58 2f 41 64 64 4c 5a 4b 4c 44 7a 59 6a 70 68 58 70 53 58 46 69 4f 4d 38 39 65 32 37 50 77 6a 47 30 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0
2024-01-15 23:16:47 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 860 Connection: close Date: Mon, 15 Jan 2024 23:16:47 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcdf-527250de6265bb677516fbc9 X-Cache: Miss from cloudfront Via: 1.1 ec22576e88e707bf58c11e0ee75d019c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: MAd5ZevgnTpmMcXBUHIfvvEqF31qKybsukIFzOZjHYg7okmtHHf87Q==
2024-01-15 23:16:47 UTC	860	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6a 4e 71 69 6d 2f 59 61 41 41 41 41 3a 34 32 46 58 36 47 45 53 4d 4a 73 64 7a 37 4c 6d 5a 41 54 47 78 45 7a 6d 34 36 5a 41 51 57 53 47 6c 78 30 53 69 43 67 6d 6d 75 74 6c 31 2f 6d 55 4d 50 65 4d 44 65 4c 58 76 58 68 67 69 67 70 72 33 33 56 4e 35 51 62 62 6a 4b 48 56 45 53 43 61 4b 39 4a 66 56 76 4e 34 65 45 6f 65 34 51 36 44 49 76 74 56 74 50 69 6b 62 5a 32 5a 4d 63 48 4c 31 47 6b 58 32 36 51 7a 55 32 71 4d 61 56 53 77 50 55 45 33 49 41 33 4e 66 62 49 77 49 77 54 5a 30 55 37 44 39 67 59 46 33 42 71 69 30 48 41 38 62 59 54 30 6a 44 4f 6f 63 5a 45 49 38 30 4b 70 31 41 74 30 55 38 4d 34 43 38 71 69 6d 6a 4a Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.5	50358	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	2785	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
2024-01-15 23:16:47 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5f0da3afcf3802cc&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfQkvAocxTBYNmSUhx942KvSqm4496Xu4Y x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: qPPdRHozOWp-Ti-Q14D0-ZBlYtDm0nEhRmYWBCnC9VQ11Y0I9ujtoA==
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.5	50359	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	249	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:16:47 GMT Content-Type: text/javascript Content-Length: 92 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d4158e9c07e0-IAD
2024-01-15 23:16:47 UTC	92	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.5	50360	172.253.63.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	386	OUT	GET /.well-known/web-identity HTTP/1.1 Host: google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	467	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/.well-known/web-identity Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 244 X-XSS-Protection: 0 Date: Mon, 15 Jan 2024 22:55:03 GMT Expires: Mon, 15 Jan 2024 23:25:03 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1304 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:47 UTC	244	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2e 77 65 6c 6c 2d 6b 6e 6f 77 6e 2f 77 65 62 2d 69 64 65 6e 74 69 74 79 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/.well-known/web-identity">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.5	50362	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	1015	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1705360602797 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:47 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Mon, 15 Jan 2024 23:16:47 GMT Date: Mon, 15 Jan 2024 23:16:47 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:47 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-01-15 23:16:47 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/u-x
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.5	50364	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	2791	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:47 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1867a3afbb0c0067&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbAKzgZFejI7y-yYkRA9WjKQeKpYgaPfZA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: QRB6MGdJzFidIJ-rohZfcI_5NG18IvRgYZpR-n_bhc4uLTBCmBuOOg==
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.5	50363	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3697	OUT	POST /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls&etgwv=js_onload_resource_transfer_size%7C228&_=1705360606651 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:47 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e3f0a3af1d2d00cc&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKH4geeFkR_xw0EGJB4XRBl4HK7_weoaFQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: EW-Va5jIsHi1KYk2moYhn4hjesAbjxRFFc6PPeP7IRLXcKjteaUwwg==
2024-01-15 23:16:47 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.5	50361	172.253.115.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Mon, 15 Jan 2024 23:16:47 GMT Date: Mon, 15 Jan 2024 23:16:47 GMT Cache-Control: private, max-age=3600 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-W632K_HP_h59NfwiSLJc4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:47 UTC	164	IN	Data Raw: 32 64 61 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 2da{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-01-15 23:16:47 UTC	573	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.5	50365	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	687	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:47 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 28 Dec 2023 21:11:24 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: oV7Y-qp611FAennaohudHx4MGjqeYkzYYTFvSZvuHBsIJYCnKt7u7Q== Age: 1562723
2024-01-15 23:16:47 UTC	16384	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-01-15 23:16:47 UTC	14236	IN	Data Raw: ad 6e e9 56 69 62 a0 5e 4f 1a 5b c0 e2 69 5e 3e 72 0a e5 47 ae 48 22 8b 77 25 5e e7 a5 e8 d7 49 6b a3 c0 16 46 e9 8c 0f bc ed fc ea b9 d2 75 5d 42 fe 59 2e 16 28 21 04 14 8c b6 7f 13 8e ff 00 8d 59 f0 c4 d6 d2 59 45 a8 4d 0b 0d f9 31 c6 07 11 af f8 d2 6a de 26 06 e6 68 2d 23 0b c8 52 db c7 7f 61 cd 34 cd 6c ba 1a e3 49 49 6d 96 49 dd 9d 93 18 2a 76 f1 55 75 0b 4b 0d 5a d1 6e 66 b5 86 69 6d 9c db b9 74 0c 46 3a 75 fc 0f e3 57 0d ec 83 4f 65 0e 17 09 d9 70 3a 7a 9a e3 74 2d 66 48 bc 4b ad e9 37 2e 4a 5d 44 2e a1 27 fb c1 46 7f 41 fa 56 75 13 56 97 62 93 5b 77 23 bf d0 b4 26 61 e6 e9 d0 8c f7 4c a1 fd 2b 12 7f 0b 68 d7 13 18 a1 7b 9b 62 7e eb 07 de a7 f3 ae a6 f8 c7 3c 0c 06 37 0e 45 72 e2 ed e2 9d d5 cf cb da b4 bb 21 a4 64 5f 7c 3f b8 00 b5 a5 fc 53 0f ee Data Ascii: nVib^O[i^>rGH"w%^IkFu]BY.(!YYEM1j&h-#Ra4lIImI*vUuKZnfimtF:uWOep:zt-fHK7.J]D.'FAVuVb[w#&aL+h{b~<7Er!d_\|?S
2024-01-15 23:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.5	50366	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3501	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1560 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	1560	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 30 7d 2c 7b Data Ascii: {"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_preselected":0},{
2024-01-15 23:16:48 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W0Ltz%2FNFFL8ngG9KqlenqNfcT69ZSOSGp%2FAA5ofOlYK89oEDmIq6ClfmHAqtC9e3NNAsqPmhlbgAsMfpP44zBL2QaF1u15Wy6yhjWVUhCH1FUVPgWOWx5ixNJkVSQfoIFZ8QmR7%2FFihL7o%2FHxVLetr2Hl112fJ%2FeY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=69b2a3af0bfa0883&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssLlFoLrXVAj7wlMmoVmvdgWbgZtCYS4Xw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A2zm_00eLsK1IuYuRBbDq_fNBG1nxCDxWiq2Mfm4yiqBzwAPloF6gA==
2024-01-15 23:16:48 UTC	21	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 30 2c 22 63 6f 64 65 22 3a 39 7d Data Ascii: {"status":0,"code":9}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.5	50367	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3500	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 721 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	721	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 61 72 64 22 3a 5b 5d 2c 22 70 61 67 65 5f 72 65 67 69 6f 6e 22 3a 22 49 6e 64 65 78 50 61 67 65 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 42 55 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 Data Ascii: {"action_name":"webcoreux.global_alert_component_served","action_version":"2.0.0","content":{"global_alert_card":[],"page_region":"IndexPage","vertical":"ABU"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142
2024-01-15 23:16:48 UTC	1183	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBJ6PYhB%2B%2BsLBPJloLEEHSaP6BVEnXURENHvf9LhDVoQodEyEJPOxqiRDEGbylFcrgWs9qAeJKYf9O7cRuv1JxUkbmw0%2FQ%2BIvZNVgRNLl%2B7ux5P3dy9yMJQyEQ8JGG6m8%2F4%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=148aa3afd3ef006b&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsv626IzWQDVJezycj20y68r66DZ0wP_U7c x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: wtPOeeNebxl4k3gzKgxMCcGB8yzdVf3la5K2XQGcJ6nyXnfyVfTiWA==
2024-01-15 23:16:48 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.5	50369	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3501	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 2085 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	2085	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 67 65 6e 69 75 73 5f 73 69 67 6e 5f 69 6e 5f 62 61 6e 6e 65 72 22 2c 22 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 68 65 61 64 65 72 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 67 65 78 5f 77 5f 69 6e 64 65 78 5f 77 68 69 74 65 5f 62 61 6e 6e 65 72 5f 73 75 62 68 65 61 64 65 72 22 2c 22 Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"genius_sign_in_banner","design_variant":"genius_sign_in_banner","title":"gex_w_index_white_banner_header","subtitle":"gex_w_index_white_banner_subheader","
2024-01-15 23:16:48 UTC	1187	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8y7IcN0ti3XLh8s%2F3lr6%2Fsb01%2F6RJmOpLwKHGT%2FxoyiCnawQzRGxy9wwxlPUJSLgM19r%2B1OniMd%2B4dzS7XjSTKnGn7ushA%2Fq5dJM%2Fzb7EdaAuA3QENy%2FmeqI8xmUtOVJrjNjxK07wE7s34IeGGJ0XdMSdUP7g7jJk%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ca5ea3b0c274014f&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuwpaulOJRaepltU3mnULL3fz71GIJA3Ho x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: _qD_t80QDZbMcdrBXcvVgUuf-mhQqpJrTil7zW_GU1kpP-S1H62sOA==
2024-01-15 23:16:48 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.5	50370	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3501	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1053 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	1053	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 65 6e 65 72 69 63 5f 62 61 6e 6e 65 72 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 64 65 73 69 67 6e 5f 76 61 72 69 61 6e 74 22 3a 22 62 6f 6f 6b 69 6e 67 5f 68 6f 6d 65 22 2c 22 62 61 6e 6e 65 72 5f 61 63 74 69 6f 6e 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 69 6e 64 65 78 22 3a 30 2c 22 61 63 74 69 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 62 6f 6f 6b 69 6e 67 2d 68 6f 6d 65 2f 69 6e 64 65 78 2e 65 6e 2d 75 73 2e 68 74 6d 6c 3f 6c 61 62 65 6c 3d Data Ascii: {"action_name":"webcoreux.generic_banner_served","action_version":"1.0.0","content":{"campaign_id":"booking_home","design_variant":"booking_home","banner_action":[{"action_index":0,"action_url":"https://www.booking.com/booking-home/index.en-us.html?label=
2024-01-15 23:16:48 UTC	1185	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhCYiP4tlENZkCrdTtlXQqFrtlz97rqG1yD6SKEv7r%2FVWe1bjs7tU6regtsntYbq4RgN041vYOQCAJNN2s%2FOXdxiU1LFMcP%2BREVyEvV2IFCa6cu9xlmKR3l%2BNrnXvk6YKx%2B%2FuC8AX47U2RPESatHFvAYM%2BfaMxeY%2F6E%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8783a3b08698013a&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstSxBvVrqEyO2smzHwf0z_nkCT8C90NWfw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: yqYAG8e9f4oBouXaqARJHXuT4-qn2XJUzF3EgpRVQ9ilKduQm6mjCA==
2024-01-15 23:16:48 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.5	50368	142.251.167.100	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:48 UTC	463	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:48 GMT Expires: Mon, 15 Jan 2024 23:46:48 GMT Cache-Control: public, max-age=1800 Server: sffe Content-Length: 251 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.5	50373	172.253.122.106	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:48 UTC	660	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 15 Jan 2024 23:16:38 GMT Expires: Tue, 16 Jan 2024 23:16:38 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT Content-Type: application/json Vary: Accept-Encoding Age: 10 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:48 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.5	50374	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:47 UTC	3972	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:47 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-01-15 23:16:48 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=eda1a3b0a0c80046&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGTmDzqFyXDkQ1J9qyq8guhTSlwbHovqtyA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 8vGnWBdmxK49NSQk99qmcKSNeqztfs6ws8CiLTcHRBZ_vbujuC3NKA==
2024-01-15 23:16:48 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 Data Ascii: {"data":{"trackAdStatus":{"childrenWithTypeReferences":{"children":{"appliedDirectives":[],"directives":[]},"empty":false,"childrenAsList":[]},"appliedDirectives":[],"extensionDefinitions":[],"coercing":{},"directivesByName":{},"children":[],"allAppliedDi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.5	50377	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	2791	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmxsvChi5frhm08bEyKTmp3MDNEPx10y2VSM8t2Ckdtu57eIUJAIP3i%2B0X3KZHG0bJuFuVPIk0%2BJNCop9fmzjnM%2FJ%2FZSwRKQIf0e1JYmCkjk7HD9MsM0AY9TjhAQBjYrnrQWYdhpPILG8n7qMdLniLKwp4NkEzj6C4%3D
2024-01-15 23:16:48 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b609a3b025ea0336&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGTV-Nr-0KYPwZCbMGjCdIgYybAFt5v3hKQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: --np0yTsZr9Dg6f2dp569X7ZTUlqBR5v2ySD-z-F2umqX2HUaX61Ug==
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.5	50375	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	4074	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-site-type-id: 1 x-booking-pageview-id: f667a3ac68470510 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-01-15 23:16:48 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W74EpfapDQ8O5vI6qUq1JxLl1DE6%2FpNxgFqjI7qH00W99RzzXHYTmXWqL26Qww5kxVO9mkIt1eN8%2FAVbfojzdLcNBePUxQWlf5yHH9J4ruDb0mX8REKFPtOm0ybb4oRRi1%2Faq8xkjaZWWvmPR4FSYDCHVc%2BCIZVyA%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=96e4a3b00a1f0037&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdZwAmrtgfB2DljXdpteRl1SD5v4LRj5GQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 9RDr9Mw87_pjQS_E7cjUFgIpeyAWPzL3lkpaitDWO2mbg32geKATbA==
2024-01-15 23:16:48 UTC	13204	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 61 73 70 65 63 74 52 61 74 69 6f 22 3a 22 35 3a 34 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 44 65 73 6b 74 6f 70 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 43 61 72 64 73 22 2c 22 70 72 69 63 65 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 63 61 72 64 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"__typename":"MerchCarousel","subHeading":null,"designVariant":{"aspectRatio":"5:4","subHeading":null,"__typename":"DesktopCarouselStackedCards","priceText":null,"card
2024-01-15 23:16:49 UTC	3128	IN	Data Raw: 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 49 74 65 6d 49 6d 61 67 65 22 2c 22 61 6c 74 22 3a 22 46 61 72 6d 20 53 74 61 79 73 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 2d 78 78 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 78 70 68 6f 74 6f 2f 33 32 30 78 34 30 30 2f 34 35 34 35 30 30 38 30 2e 6a 70 65 67 3f 6b 3d 31 35 64 39 37 30 39 65 66 61 35 31 33 66 32 62 32 33 62 35 66 61 38 64 35 32 33 34 64 38 37 62 64 65 65 32 62 66 39 37 62 33 65 37 35 35 32 32 34 34 35 39 32 64 61 31 31 34 31 33 64 62 39 61 26 6f 3d 22 2c 22 69 64 22 3a 34 35 34 35 30 30 38 30 7d 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 69 74 65 6d 49 64 22 3a 22 64 34 33 63 32 65 33 33 2d 39 65 38 30 2d 34 32 39 35 2d 61 30 63 39 2d 63 Data Ascii: :"MerchCarouselItemImage","alt":"Farm Stays","url":"https://r-xx.bstatic.com/xdata/images/xphoto/320x400/45450080.jpeg?k=15d9709efa513f2b23b5fa8d5234d87bdee2bf97b3e7552244592da11413db9a&o=","id":45450080},"filters":null,"itemId":"d43c2e33-9e80-4295-a0c9-c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.5	50376	172.253.63.132	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:48 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Mon, 15 Jan 2024 23:16:48 GMT Expires: Tue, 14 Jan 2025 23:16:48 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:48 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-01-15 23:16:48 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.5	50378	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	4074	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-site-type-id: 1 x-booking-pageview-id: f667a3ac68470510 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-01-15 23:16:48 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT90itilinZZIOUQxKoMbVbRyKvauvm%2FqpOjOxNTyS78nUTGUpGeqLNjHvdbVfxZeZZ8bsdZzVEkS3OAVbwJliVOZBru6b9zkj5EJ4cqHCgu2%2B%2B6TG6EF9zvHhzZ%2FOUeveX97jvcZleFtruc%2BvRjtr5pg4ON0CnpTtw%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c69fa3b04db100f3&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcwR_dbqOGVdzlrcF61TiTraNJ7RCGvXrA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 1448f69604d5be1f9c9f0c64cfa90594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: zJ4KKoKO2vGxK0JVd5I-ro91vO87ZWKI_TgYkXC2pmsmpNpLDdaOeQ==
2024-01-15 23:16:48 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 68 65 61 64 69 6e 67 22 3a 22 45 78 70 6c 6f 72 65 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d 65 72 69 63 61 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 22 54 68 65 73 65 20 70 6f 70 75 6c 61 72 20 64 65 73 74 69 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"heading":"Explore United States of America","__typename":"MerchCarousel","carouselCampaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32cad","subHeading":"These popular desti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.5	50379	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	3972	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 540 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	540	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 54 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 63 61 6d 70 61 69 67 6e 49 64 5c 6e 20 20 20 20 63 61 72 6f 75 73 65 6c 4e 61 6d 65 5c 6e 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 73 75 62 74 69 74 6c 65 5c 6e 20 20 20 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 7b 5c 6e 20 20 20 20 20 20 69 6d 61 67 65 55 72 6c 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 64 69 73 74 61 Data Ascii: {"operationName":"TripTypeDestinations","variables":{},"extensions":{},"query":"query TripTypeDestinations {\n tripTypeDestinations {\n campaignId\n carouselName\n title\n subtitle\n destinations {\n imageUrl\n title\n dista
2024-01-15 23:16:48 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 38 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:48 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCrRQJj4Vk7QFJ4h4AyxMKgXqNCxpln6KfpXX1KQgaytarq%2BUvFrT2AaUZ5NGxvBKi0eoVY8FFbjcIijzs%2BXlQbxU%2BvxtSj5e0p8%2FCFogcbN2bNHphMH%2FTdYLcKlNRy%2FiamSb7M3t0D6XjXWzQJrrm3rmsUljmg4R2Y%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f405a3b0bd05007f&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGT0i6pTbHqarpqJVWeZc6E9-GHWOnzBjaw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: NXoMxFZNHD1sXwQvrrGvkPGvkfLd9iXlUP3zWmvPVfsFwgYnCrgAIA==
2024-01-15 23:16:48 UTC	38	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 69 70 54 79 70 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 22 3a 6e 75 6c 6c 7d 7d Data Ascii: {"data":{"tripTypeDestinations":null}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.5	50381	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1525	OUT	GET /pagead/viewthroughconversion/988382855/?random=1705360607644&cv=11&fst=1705360607644&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:48 UTC	549	IN	Data Raw: 39 66 30 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 9f0(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:48 UTC	750	IN	Data Raw: 78 33 64 31 37 30 35 33 36 30 36 30 37 36 34 34 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 44 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 Data Ascii: x3d1705360607644\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46Ad
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.5	50385	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	4074	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-site-type-id: 1 x-booking-pageview-id: f667a3ac68470510 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 30 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":60}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:49 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 13100 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVkD%2FkZDN%2FWh7Bk8HegJOxwYc5nTD48G26ELnzdYwuGjJ1ucSfNkSVsVzIzhyU%2BB8eo9g13lr4U6Zs2LLapqrrEcqLyMrGoxn3zm2ODa6EVsz8kivXyODTY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3b9ea3b0039a01bd&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGeVfrRCnOIMeAyGCkV1aGbvN0QH8QsSUeA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: cLhefkqDZpvt7T8hg8xtzfdlkWe1cD04aHoo6Pb1he5-ovrWQnMirA==
2024-01-15 23:16:49 UTC	13100	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 7b 22 64 65 73 74 54 79 70 65 22 3a 22 4e 4f 5f 44 45 53 54 5f 54 59 50 45 22 2c 22 74 72 61 76 65 6c 50 75 72 70 6f 73 65 22 3a 30 2c 22 73 65 6c 65 63 74 65 64 46 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 63 68 65 63 6b 69 6e 22 3a 22 22 2c 22 6e 62 43 68 69 6c 64 72 65 6e 22 3a 30 2c 22 63 68 69 6c 64 72 65 6e 41 67 65 73 22 3a 5b 5d 2c 22 6e 62 52 6f 6f 6d 73 22 3a 30 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 2c 22 64 65 73 74 Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"landingOptions":{"destType":"NO_DEST_TYPE","travelPurpose":0,"selectedFilters":null,"checkin":"","nbChildren":0,"childrenAges":[],"nbRooms":0,"__typename":"LandingOptions","dest

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.5	50383	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1024	OUT	POST /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=50931350.1705360608&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:48 UTC	826	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=50931350.1705360608&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.5	50387	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1366	OUT	GET /activity;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	1308	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.5	50388	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1964	OUT	GET /pagead/viewthroughconversion/1060768846/?random=1705360607860&cv=11&fst=1705360607860&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:48 UTC	549	IN	Data Raw: 62 63 34 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: bc4(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:48 UTC	1218	IN	Data Raw: 33 64 31 37 30 35 33 36 30 36 30 37 38 36 30 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 68 6c 5c 78 33 64 65 6e 5c 78 32 36 67 6c 5c 78 33 64 75 73 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 Data Ascii: 3d1705360607860\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26hl\x3den\x26gl\x3dus\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.5	50386	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	4074	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1794 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-site-type-id: 1 x-booking-pageview-id: f667a3ac68470510 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	1794	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 2c 22 64 61 74 65 73 22 3a 7b 22 63 68 65 63 6b 69 6e 22 3a 22 32 30 32 34 2d 30 31 2d 31 35 22 2c 22 63 68 65 63 6b 6f 75 74 22 3a 22 32 30 32 34 2d 30 31 2d 31 36 22 7d 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 36 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2,"dates":{"checkin":"2024-01-15","checkout":"2024-01-16"}},"acidCarouselContext":{"acidCarouselId":67}}},"extensions":{},"query":"query AcidCarouselSearch($input:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.5	50390	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1524	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360607901&cv=11&fst=1705360607901&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:48 UTC	549	IN	Data Raw: 39 65 65 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 9ee(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:48 UTC	748	IN	Data Raw: 64 31 37 30 35 33 36 30 36 30 37 39 30 31 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 44 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d Data Ascii: d1705360607901\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.5	50392	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1524	OUT	GET /pagead/viewthroughconversion/973712236/?random=1705360607937&cv=11&fst=1705360607937&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:48 UTC	549	IN	Data Raw: 39 65 62 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 9eb(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:48 UTC	745	IN	Data Raw: 64 31 37 30 35 33 36 30 36 30 37 39 33 37 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 44 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d Data Ascii: d1705360607937\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.5	50395	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	4074	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1737 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-site-type-id: 1 x-booking-pageview-id: f667a3ac68470510 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:48 UTC	1737	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 62 61 73 69 63 53 65 61 72 63 68 49 6e 70 75 74 22 3a 7b 22 6e 62 41 64 75 6c 74 73 22 3a 32 7d 2c 22 61 63 69 64 43 61 72 6f 75 73 65 6c 43 6f 6e 74 65 78 74 22 3a 7b 22 61 63 69 64 43 61 72 6f 75 73 65 6c 49 64 22 3a 35 37 7d 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 41 63 69 64 43 61 72 6f 75 73 65 6c 53 65 61 72 63 68 28 24 69 6e 70 75 74 3a 20 41 63 69 64 43 61 72 6f 75 73 65 6c 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 73 65 61 72 63 68 51 75 65 72 69 65 73 20 7b 5c 6e 20 20 20 20 73 65 61 72 63 68 41 63 69 64 43 Data Ascii: {"operationName":"AcidCarouselSearch","variables":{"input":{"basicSearchInput":{"nbAdults":2},"acidCarouselContext":{"acidCarouselId":57}}},"extensions":{},"query":"query AcidCarouselSearch($input: AcidCarouselInput!) {\n searchQueries {\n searchAcidC
2024-01-15 23:16:49 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 204 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATP1nlUf1xdIceF%2Fjw3G9PCUCG7dQsm03T%2Fv8BQri083aHLtwJn4H5sQS1ok6Uk%2BaUO6Yu6YqaL3YnheyzEAqza6cA0j55Utm08QJKyH7rW1S1aKkC9k7ofl0LRCFnNRG2XE6KDSCri3w%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:48 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=68aba3b031580154&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRAalCPpi8Il4ZH55DRPc4_d2eJiL2kLkA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 4XMhN8DPZ_2oHZsUMXCS30hlm_y8OLeVO0MNjIl2arIWQLigbXt4gQ==
2024-01-15 23:16:49 UTC	204	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 73 65 61 72 63 68 51 75 65 72 69 65 73 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 53 65 61 72 63 68 51 75 65 72 69 65 73 22 2c 22 73 65 61 72 63 68 41 63 69 64 43 61 72 6f 75 73 65 6c 22 3a 7b 22 61 63 69 64 43 61 72 64 73 22 3a 5b 5d 2c 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 6c 61 6e 64 69 6e 67 4f 70 74 69 6f 6e 73 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 41 63 69 64 43 61 72 6f 75 73 65 6c 4f 75 74 70 75 74 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 68 61 73 41 76 61 69 6c 61 62 69 6c 69 74 79 22 3a 66 61 6c 73 65 7d 7d 7d 7d Data Ascii: {"data":{"searchQueries":{"__typename":"SearchQueries","searchAcidCarousel":{"acidCards":[],"title":null,"landingOptions":null,"__typename":"AcidCarouselOutput","subtitle":null,"hasAvailability":false}}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.5	50394	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	1524	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360607982&cv=11&fst=1705360607982&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:48 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:48 UTC	549	IN	Data Raw: 39 65 65 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 9ee(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:48 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:48 UTC	748	IN	Data Raw: 64 31 37 30 35 33 36 30 36 30 37 39 38 32 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 44 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d Data Ascii: d1705360607982\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM
2024-01-15 23:16:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.5	50399	172.253.63.138	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:48 UTC	641	OUT	HEAD /about/enterprise/ HTTP/1.1 Host: marketingplatform.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:49 UTC	887	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Content-Length: 125161 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/marketing_platform Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/marketing_platform" Report-To: {"group":"uxe-owners-acl/marketing_platform","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/marketing_platform"}]} Date: Mon, 15 Jan 2024 23:16:49 GMT Expires: Mon, 15 Jan 2024 23:16:49 GMT Cache-Control: private, max-age=3000 Last-Modified: Tue, 09 Jan 2024 09:58:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.5	50401	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	2801	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A35+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BRtKHnxHt2mRW%2B%2BAOT5uI%2BlK1nabE0AFD%2BathnduIOfsy6D3EJLONgVSUF1dzZf6t7rOMdlhmZqjsf7WOb5p8hvM9pE6co%2FvGOKc0Mcl%2FqGmQGn8uDIc2PTVog54Iwa4MS1SYcgXi%2FAvc7C8eKLaqgzGZr%2BuOCEIM%3D
2024-01-15 23:16:49 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4e63a3b01ec600a0&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGTQW-Ovtvi-fIr1DL8Z3NHGqDSAQ6io_cA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 14d757a67b913f1bc93427e69819362c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: TuPGbdeHgy3WQXYGObn8NY5VuXa6zQDmocA3Vzb8QZ-gheGf6Hnyew==
2024-01-15 23:16:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.5	50396	142.251.16.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:49 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:49 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Content-Security-Policy: script-src 'report-sample' 'nonce-FpmkMjr2nra91Jfol6basA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:49 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-01-15 23:16:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.5	50403	216.239.36.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3176	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360606642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=50931350.1705360608&sst.gcd=11l1l1l1l5&sst.tft=1705360606642&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8521&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577
2024-01-15 23:16:49 UTC	568	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: d4be85cf7d9c232c0664063d3fd7fc79 Date: Mon, 15 Jan 2024 23:16:49 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:49 GMT Connection: close
2024-01-15 23:16:49 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.5	50404	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1524	OUT	GET /pagead/viewthroughconversion/975716499/?random=1705360608028&cv=11&fst=1705360608028&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&gcd=11l1l1l1l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&auid=460620828.1705360583&fledge=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:49 UTC	703	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:49 UTC	549	IN	Data Raw: 39 65 64 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: 9ed(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b 22 29 7d 3b 21 78 28 22 41 6e 64 72 6f 69 64 22 29 7c 7c 7a 28 29 3b 7a 28 29 3b 21 78 28 22 53 61 66 61 72 69 22 29 7c 7c 7a 28 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 43 6f 61 73 74 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 4f 70 65 72 61 22 29 29 7c 7c 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 28 79 28 29 3f 77 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 78 28 22 45 64 67 Data Ascii: ?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg
2024-01-15 23:16:49 UTC	747	IN	Data Raw: 64 31 37 30 35 33 36 30 36 30 38 30 32 38 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 30 35 33 35 39 36 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 48 65 34 31 61 30 76 37 39 36 31 35 34 36 31 5c 78 32 36 75 5f 77 5c 78 33 64 31 32 38 30 5c 78 32 36 75 5f 68 5c 78 33 64 31 30 32 34 5c 78 32 36 75 72 6c 5c 78 33 64 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 69 6e 64 65 78 2e 68 74 6d 6c 25 33 46 61 69 64 25 33 44 33 30 34 31 34 32 25 32 36 6c 61 62 65 6c 25 33 44 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d Data Ascii: d1705360608028\x26cv\x3d11\x26fst\x3d1705359600000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45He41a0v79615461\x26u_w\x3d1280\x26u_h\x3d1024\x26url\x3dhttps%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM
2024-01-15 23:16:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.5	50398	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	856	OUT	GET /pagead/viewthroughconversion/1060768846/value=1.00&guid=ON&script=0&label=undefined HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:49 UTC	782	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://www.google.com/pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_IIz2dK4FKIiOPT1_TLlWCJh110njpmcKCcLaLfAgEwoSW5mM&random=246440793 Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.5	50405	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:49 UTC	564	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:49 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 185 x-envoy-upstream-service-time: 35 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	185	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 31 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"1","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.5	50416	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1047	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360608473&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
2024-01-15 23:16:49 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 6 referrer-policy: origin x-pinterest-rid: 5203311361308422 Date: Mon, 15 Jan 2024 23:16:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:49 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.5	50407	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2317 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:49 UTC	2317	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6a 4e 71 69 6d 2f 59 61 41 41 41 41 3a 34 32 46 58 36 47 45 53 4d 4a 73 64 7a 37 4c 6d 5a 41 54 47 78 45 7a 6d 34 36 5a 41 51 57 53 47 6c 78 30 53 69 43 67 6d 6d 75 74 6c 31 2f 6d 55 4d 50 65 4d 44 65 4c 58 76 58 68 67 69 67 70 72 33 33 56 4e 35 51 62 62 6a 4b 48 56 45 53 43 61 4b 39 4a 66 56 76 4e 34 65 45 6f 65 34 51 36 44 49 76 74 56 74 50 69 6b 62 5a 32 5a 4d 63 48 4c 31 47 6b 58 32 36 51 7a 55 32 71 4d 61 56 53 77 50 55 45 33 49 41 33 4e 66 62 49 77 49 77 54 5a 30 55 37 44 39 67 59 46 33 42 71 69 30 48 41 38 62 59 54 30 6a 44 4f 6f 63 5a 45 49 38 30 4b 70 31 41 74 30 55 38 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8
2024-01-15 23:16:49 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 948 Connection: close Date: Mon, 15 Jan 2024 23:16:49 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce1-22c0c9c350e23f0953fdaf12 X-Cache: Miss from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: RnPEmIYl1KsnAN6SiiPyEsA5dBR61XbGOu3lC1fIfgGRMUEMwwZrdA==
2024-01-15 23:16:49 UTC	948	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 70 74 6d 6a 41 4b 49 51 41 41 41 41 3a 4b 46 2f 62 6a 48 49 75 58 6c 75 39 32 30 64 6e 79 54 4b 5a 6f 51 41 4b 55 30 35 77 56 6e 72 52 54 38 2b 6f 64 71 69 46 54 68 7a 41 43 52 6d 43 77 71 35 61 45 34 34 52 2f 71 4b 33 6b 58 2b 7a 4f 73 54 7a 51 45 68 68 49 5a 31 6b 43 6b 31 64 75 70 35 46 63 2b 78 44 77 56 38 31 4e 32 43 76 61 6b 77 4b 51 68 33 73 6c 4d 2f 6b 54 71 6b 78 45 63 57 56 55 6a 6e 39 72 73 42 35 64 6c 5a 57 2f 6d 64 6c 4a 64 4e 4c 42 55 33 69 52 49 70 65 6a 58 59 59 50 61 77 47 4e 32 44 6f 6d 79 37 68 54 63 76 4b 54 6b 6e 2f 63 79 51 43 4a 4f 63 6c 6f 64 61 64 65 2f 45 2f 72 4c 42 62 37 59 47 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.5	50408	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1845	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=1a065792-be81-49f6-b178-47e74a8775d1&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=3329&m_fcps=3006&m_pi=3312&m_pl=6960&m_pv=2&m_rd=8599&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&trackId=2cfd8eee-8e7d-4b46-a553-5748470cbd20&ts=1705360608302&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:49 UTC	526	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:49 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.5	50415	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	988	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360608474&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
2024-01-15 23:16:49 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 1831094716384406 Date: Mon, 15 Jan 2024 23:16:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:49 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.5	50409	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3500	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 683 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:49 UTC	683	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 64 33 34 37 39 35 63 2d 61 38 38 30 2d 34 35 34 38 2d 62 64 37 38 2d 65 35 36 66 66 35 66 61 39 37 33 33 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 Data Ascii: {"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"0d34795c-a880-4548-bd78-e56ff5fa9733"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAE
2024-01-15 23:16:49 UTC	1179	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVTp06xHCtXKlssk%2FURMgi5QpqK6zfSFogWJdHWbBbCev%2B%2Fj73KmWwfzRaPR7z1AMwnODiphGTunpuHdaw0LNZoYMxEvcxVQtckUdGVu1CKO8DfE0W45FQc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=303ba3b05d8d01ed&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvWC3kzaGhFE9OQl8Saa-jCA2wLKdyQs74 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: RU_0rpMX_bGbgQ8aYR77GfLnDS6IF6pLggMQzblLaWfWsn2JCIBIGw==
2024-01-15 23:16:49 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.5	50413	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	4590	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:49 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5740a3b0436f0032&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLKuRvLoriBQuYLSCobxLiAZEteYmGlO9s x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 9Mma0Iwa2Jk2JDgtlDg9SlDNVQD5Q-4vxLUIzNwrB1RKzv93LRclSA==
2024-01-15 23:16:49 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.5	50412	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	629	OUT	GET /activeview/js/current/ufs_web_display.js?cache=r20110914 HTTP/1.1 Host: www.googletagservices.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://38422f60eae957c2f7969377f317b22c.safeframe.googlesyndication.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:49 UTC	829	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl Cross-Origin-Opener-Policy: same-origin; report-to="active-view-scs-read-write-acl" Report-To: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} Timing-Allow-Origin: * Content-Length: 209810 Date: Mon, 15 Jan 2024 23:16:49 GMT Expires: Mon, 15 Jan 2024 23:16:49 GMT Cache-Control: private, max-age=3000 ETag: "1704891455226136" X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	423	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 2c 62 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e Data Ascii: (function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 2c 64 61 3d 0a 63 61 28 74 68 69 73 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 29 61 3a 7b 76 61 72 20 63 3d 64 61 3b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 2d 31 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 61 5b 64 5d 3b 69 66 28 21 28 65 20 69 6e 20 63 29 29 62 72 65 61 6b 20 61 3b 63 3d 63 5b 65 5d 7d 61 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 64 3d 63 5b 61 5d 3b 62 3d 62 28 64 29 3b 62 21 3d 64 26 26 6e 75 Data Ascii: ;for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=ca(this),p=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&nu
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 72 61 77 3d 62 3b 72 65 74 75 72 6e 20 61 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 63 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 Data Ascii: =function(a,b){a.raw=b;return a},t=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error("c`"+String(a));},u=function(a){if(!(a instanceof Array)
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 71 63 3d 21 31 3b 74 68 69 73 2e 69 62 3d 6e 75 6c 6c 3b 74 68 69 73 2e 65 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 6b 61 3d 31 3b 74 68 69 73 2e 4d 61 3d 74 68 69 73 2e 6b 62 3d 30 3b 74 68 69 73 2e 68 65 3d 74 68 69 73 2e 65 61 3d 6e 75 6c 6c 7d 3b 73 61 2e 70 72 6f 74 6f 74 79 70 65 2e 57 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 71 63 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 66 22 29 3b 74 68 69 73 2e 71 63 3d 21 30 7d 3b 73 61 2e 70 72 6f 74 6f 74 79 70 65 2e 76 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 65 66 3d 61 7d 3b 0a 73 61 2e 70 72 6f 74 6f 74 79 70 65 2e 46 63 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 65 61 3d 7b 43 66 Data Ascii: =function(){this.qc=!1;this.ib=null;this.ef=void 0;this.ka=1;this.Ma=this.kb=0;this.he=this.ea=null};sa.prototype.Wa=function(){if(this.qc)throw new TypeError("f");this.qc=!0};sa.prototype.vc=function(a){this.ef=a};sa.prototype.Fc=function(a){this.ea={Cf
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 6f 66 20 4f 62 6a 65 63 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 65 60 22 2b 65 29 3b 69 66 28 21 65 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 61 2e 73 2e 71 63 3d 21 31 2c 65 3b 76 61 72 20 66 3d 65 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 67 29 7b 72 65 74 75 72 6e 20 61 2e 73 2e 69 62 3d 6e 75 6c 6c 2c 61 2e 73 2e 46 63 28 67 29 2c 79 61 28 61 29 7d 61 2e 73 2e 69 62 3d 6e 75 6c 6c 3b 64 2e 63 61 6c 6c 28 61 2e 73 2c 66 29 3b 72 65 74 75 72 6e 20 79 61 28 61 29 7d 2c 79 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 3b 61 2e 73 2e 6b 61 3b 29 74 72 79 7b 76 61 72 20 62 3d 61 2e 75 69 28 61 2e 73 29 3b 69 66 28 62 29 72 65 74 75 72 6e 20 61 2e 73 2e 71 63 3d 21 31 2c 7b 76 61 6c 75 65 3a 62 2e 76 61 6c 75 65 2c 64 6f 6e Data Ascii: of Object))throw new TypeError("e`"+e);if(!e.done)return a.s.qc=!1,e;var f=e.value}catch(g){return a.s.ib=null,a.s.Fc(g),ya(a)}a.s.ib=null;d.call(a.s,f);return ya(a)},ya=function(a){for(;a.s.ka;)try{var b=a.ui(a.s);if(b)return a.s.qc=!1,{value:b.value,don
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 74 68 3b 63 2b 2b 29 62 5b 63 2d 61 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 72 65 74 75 72 6e 20 62 7d 3b 0a 70 28 22 50 72 6f 6d 69 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 74 68 69 73 2e 59 61 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 63 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 67 3a 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 28 67 29 7d 29 7d 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 70 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 59 61 29 7b 74 68 69 73 2e 59 61 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 71 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 6f 68 Data Ascii: th;c++)b[c-a]=arguments[c];return b};p("Promise",function(a){function b(){this.Ya=null}function c(g){return g instanceof e?g:new e(function(k){k(g)})}if(a)return a;b.prototype.pf=function(g){if(null==this.Ya){this.Ya=[];var k=this;this.qf(function(){k.oh
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 73 67 28 31 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 73 67 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 69 66 28 30 21 3d 74 68 69 73 2e 59 62 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 68 60 22 2b 67 2b 22 60 22 2b 6b 2b 22 60 22 2b 74 68 69 73 2e 59 62 29 3b 74 68 69 73 2e 59 62 3d 67 3b 74 68 69 73 2e 43 63 3d 6b 3b 32 3d 3d 3d 74 68 69 73 2e 59 62 26 26 74 68 69 73 2e 46 69 28 29 3b 74 68 69 73 2e 70 68 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 46 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 67 2e 66 69 28 29 29 7b 76 61 72 20 6b 3d 64 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 Data Ascii: function(g){this.sg(1,g)};e.prototype.sg=function(g,k){if(0!=this.Yb)throw Error("h`"+g+"`"+k+"`"+this.Yb);this.Yb=g;this.Cc=k;2===this.Yb&&this.Fi();this.ph()};e.prototype.Fi=function(){var g=this;d(function(){if(g.fi()){var k=da.console;"undefined"!==ty
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 2c 6b 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 29 7b 73 77 69 74 63 68 28 6c 2e 59 62 29 7b 63 61 73 65 20 31 3a 67 28 6c 2e 43 63 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 6b 28 6c 2e 43 63 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 60 22 2b 0a 6c 2e 59 62 29 3b 7d 7d 76 61 72 20 6c 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 54 62 3f 66 2e 70 66 28 68 29 3a 74 68 69 73 2e 54 62 2e 70 75 73 68 28 68 29 3b 74 68 69 73 2e 59 66 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 68 29 7b 68 28 67 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 Data Ascii: ,k){function h(){switch(l.Yb){case 1:g(l.Cc);break;case 2:k(l.Cc);break;default:throw Error("i`"+l.Yb);}}var l=this;null==this.Tb?f.pf(h):this.Tb.push(h);this.Yf=!0};e.resolve=c;e.reject=function(g){return new e(function(k,h){h(g)})};e.race=function(g){r
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 28 6d 29 7b 69 66 28 6d 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 72 65 74 75 72 6e 20 6d 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 68 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 68 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 68 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 Data Ascii: (m){if(m instanceof b)return m;Object.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var h=Object.seal({}),l=Object.seal({}),m=new a([[h,2],[l,3]]);if(2!=m.get(h)\|\|3!=m.get(l))return!1;m.delete(h);m.set(l,4);return!m.ha
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 2e 64 6f 6e 65 7c 7c 34 21 3d 6d 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 22 74 22 21 3d 6d 2e 76 61 6c 75 65 5b 31 5d 7c 7c 21 6c 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 3f 21 31 3a 21 30 7d 63 61 74 63 68 28 72 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 74 28 6b 29 3b 66 6f 72 28 76 61 72 20 68 3b 21 28 68 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 68 3d 68 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 68 5b 30 5d 2c 68 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e Data Ascii: .done\|\|4!=m.value[0].x\|\|"t"!=m.value[1]\|\|!l.next().done?!1:!0}catch(r){return!1}}())return a;var b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=t(k);for(var h;!(h=k.next()).done;)h=h.value,this.set(h[0],h[1])}};c.prototype.set=fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.5	50417	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	885	OUT	GET /pagead/landing?gcs=G1--&gcd=11l1l1l1l5&rnd=50931350.1705360608&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&gtm=45He41a0n815Q664QZv79615461&auid=460620828.1705360583 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:49 UTC	652	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.5	50418	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 956 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:49 UTC	956	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 62 62 39 39 38 65 33 38 2d 30 33 32 64 2d 34 37 62 31 2d 39 34 31 35 2d 39 38 64 63 34 63 62 36 65 37 32 63 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"bb998e38-032d-47b1-9415-98dc4cb6e72c","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:49 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:49 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.5	50425	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3500	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 701 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:49 UTC	701	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 30 32 62 39 33 31 32 31 2d 63 66 66 33 2d 34 34 33 35 2d 61 63 33 61 2d 36 65 61 65 63 36 30 31 65 35 36 30 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"02b93121-cff3-4435-ac3a-6eaec601e560"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142&la
2024-01-15 23:16:49 UTC	1171	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXM5xILsmTuK9yovbZwzJFnVyIYglkmsNAYWHO0xZrjVFknq3VFCn6pM8Bj7BDZZNEgwnWqTrDWCZ9Z8DVXHiI1Mx5gtE0IFNimhajGuSwaa0thXEAmgO7KdNAD1mVIEPXP4VUSvmg7HZ2V2gJhWY09I%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8517a3b045940220&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssLrHaCXkxHmdzWwxfb007Ebf-UjwVf9l8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: T1pAWwENZqXvU7JlGUOs9IaTFo-T5tI5cA8-aByBmPqA3PSbqf8ojw==
2024-01-15 23:16:49 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.5	50414	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1238	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:49 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 15 Jan 2024 23:16:49 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-D7qgbp1mPaeVNlwz5QT8pw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:49 UTC	361	IN	Data Raw: 32 61 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2a54<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 46 46 2c 20 55 2b 32 30 32 30 2c 20 55 2b 32 30 41 30 2d 32 30 41 42 2c 20 55 2b 32 30 41 44 2d 32 30 43 46 2c 20 Data Ascii: boto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF,
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 Data Ascii: font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-sty
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 37 34 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a Data Ascii: to/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d Data Ascii: * vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 70 31 6d 50 61 65 56 4e 6c 77 7a 35 51 54 38 70 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 44 37 71 67 62 Data Ascii: p1mPaeVNlwz5QT8pw" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/u-xcq3POCWFlCr3x8_IPxgPu/recaptcha__en.js" nonce="D7qgb
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 53 46 72 66 6d 46 42 34 68 79 5f 4c 69 61 38 47 5a 54 58 47 30 41 55 62 79 43 63 43 76 45 42 43 7a 57 6d 6e 71 61 50 6b 6d 35 41 72 65 70 34 6b 6e 5a 38 77 4d 49 56 43 32 41 6e 43 42 64 61 45 46 6e 5f 32 59 47 67 6d 6a 57 5f 57 6f 58 6d 7a 49 54 58 38 6d 4a 4f 75 6e 79 69 37 49 32 44 62 34 47 36 69 36 55 64 44 4d 66 52 68 37 50 4a 6f 74 47 5f 51 35 4c 54 68 54 33 65 64 71 31 4b 4c 4a 4a 6f 43 43 32 67 4d 4e 38 5f 72 41 4b 4c 70 53 6e 30 30 69 79 68 52 6f 57 61 58 43 6a 5f 52 58 72 33 48 59 65 79 55 69 77 5f 53 56 76 6a 79 31 6c 2d 46 79 36 42 70 68 2d 68 75 77 79 7a 6b 4a 5f 76 79 39 77 43 53 79 72 34 75 30 4a 49 64 6f 4e 77 5a 4d 6b 74 73 5a 76 4b 52 5f 67 39 37 63 65 72 63 36 5f 2d 5a 49 77 7a 32 4e 42 42 53 54 63 67 46 5f 4e 72 73 52 54 70 6b 39 73 51 Data Ascii: SFrfmFB4hy_Lia8GZTXG0AUbyCcCvEBCzWmnqaPkm5Arep4knZ8wMIVC2AnCBdaEFn_2YGgmjW_WoXmzITX8mJOunyi7I2Db4G6i6UdDMfRh7PJotG_Q5LThT3edq1KLJJoCC2gMN8_rAKLpSn00iyhRoWaXCj_RXr3HYeyUiw_SVvjy1l-Fy6Bph-huwyzkJ_vy9wCSyr4u0JIdoNwZMktsZvKR_g97cerc6_-ZIwz2NBBSTcgF_NrsRTpk9sQ
2024-01-15 23:16:49 UTC	1252	IN	Data Raw: 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 59 31 6c 43 62 6b 78 34 55 45 63 32 51 30 35 7a 59 33 52 34 52 57 56 30 54 32 35 53 61 6a 64 69 52 31 56 75 4d 46 5a 47 62 55 68 33 56 6d 64 59 55 54 64 79 55 6a 41 31 59 55 6c 6d 61 58 6b 35 4f 45 78 6e 62 30 59 72 56 46 4a 77 51 32 70 71 62 6d 59 79 4d 6b 45 35 54 45 68 53 64 57 4a 77 4f 48 70 34 65 6e 59 7a 56 6c 5a 6e 4d 54 46 6f 64 47 68 59 64 56 4e 4e 55 47 38 33 63 55 5a 54 57 47 35 57 63 58 68 6c 59 30 46 35 57 6b 64 43 55 58 68 6e 54 6b 56 50 62 45 4a 72 52 47 4d 79 51 6a 42 51 Data Ascii: vbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz\x22,\x22\x22,\x22Y1lCbkx4UEc2Q05zY3R4RWV0T25SajdiR1VuMFZGbUh3VmdYUTdyUjA1YUlmaXk5OExnb0YrVFJwQ2pqbmYyMkE5TEhSdWJwOHp4enYzVlZnMTFodGhYdVNNUG83cUZTWG5WcXhlY0F5WkdCUXhnTkVPbEJrRGMyQjBQ
2024-01-15 23:16:49 UTC	467	IN	Data Raw: 44 68 75 62 6b 78 49 51 33 64 72 4d 6d 68 4a 56 55 4d 79 61 30 4e 58 4f 56 4e 31 4d 58 51 31 64 46 4e 49 61 47 34 35 53 6d 46 33 57 55 4a 51 53 47 35 50 65 6b 4a 53 57 47 59 33 5a 6b 46 4d 57 47 46 6a 51 33 6c 46 4e 45 31 74 4d 56 4a 55 5a 56 64 69 63 48 4a 44 4e 6a 6c 6e 5a 55 78 57 61 6d 52 71 62 31 70 42 51 6e 46 54 5a 45 39 55 4b 30 70 5a 4b 33 68 53 4d 57 67 35 57 6a 4a 76 4d 7a 42 75 62 46 42 35 63 6b 56 71 53 58 6f 31 4d 33 64 51 61 30 5a 49 55 48 64 78 56 58 64 5a 51 30 6c 4f 4d 45 77 34 64 55 68 5a 63 6d 78 48 5a 31 6c 7a 52 56 56 6c 63 57 78 47 5a 32 31 77 55 56 56 46 61 55 68 59 53 6a 52 4e 55 6c 41 77 4e 33 68 58 4e 30 56 35 62 57 6f 76 59 32 38 78 53 44 51 32 4f 46 56 53 65 45 5a 74 65 6d 39 47 4e 7a 4d 33 61 54 4d 78 53 47 56 34 5a 31 56 46 Data Ascii: DhubkxIQ3drMmhJVUMya0NXOVN1MXQ1dFNIaG45SmF3WUJQSG5PekJSWGY3ZkFMWGFjQ3lFNE1tMVJUZVdicHJDNjlnZUxWamRqb1pBQnFTZE9UK0pZK3hSMWg5WjJvMzBubFB5ckVqSXo1M3dQa0ZIUHdxVXdZQ0lOMEw4dUhZcmxHZ1lzRVVlcWxGZ21wUVVFaUhYSjRNUlAwN3hXN0V5bWovY28xSDQ2OFVSeEZtem9GNzM3aTMxSGV4Z1VF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.5	50423	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3500	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 701 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:49 UTC	701	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 73 65 63 6f 6e 64 61 72 79 5f 62 61 6e 6e 65 72 5f 63 61 72 6f 75 73 65 6c 5f 62 61 6e 6e 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 66 65 38 63 66 36 2d 31 63 38 39 2d 34 66 35 37 2d 39 62 38 65 2d 64 64 62 31 30 62 35 64 30 62 66 63 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 Data Ascii: {"action_name":"webcoreux.secondary_banner_carousel_banner_viewed","action_version":"1.0.0","content":{"campaign_id":"32fe8cf6-1c89-4f57-9b8e-ddb10b5d0bfc"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142&la
2024-01-15 23:16:49 UTC	1187	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedG%2FUq4y25F%2FaBn5Z3xc0L2i3meSkomztecVqrhopA%2FFpoD0I%2FEs3sbPsoqPylch%2BuIQc5qHGjRqfMlA0tN8uylkQRHmD3BvDnoReoDiVtXRwAUcOKpe2nlftSGJoffHQMJ%2F5Js0A0%2F%2BjnpmlTPz2Q%2F15MyNRcvd6o%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=34a1a3b0fa7400a2&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvwC4YgwTGKvdB1fQ3A7XoCC3h0xJx3YhM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: d7MbNj47cmXbv4UBEbvQXB0vqRADc6bWf23dUS4a981yw-zPq0-XhQ==
2024-01-15 23:16:49 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.5	50419	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1443	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:49 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"15523521832281590314"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11707336131466150419","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"15523521832281590314","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"15523521832281590314","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"15523521832281590314","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"15523521832281590314","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:16:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.5	50427	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3500	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 738 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D; lastSeen=0
2024-01-15 23:16:49 UTC	738	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 64 65 73 74 69 6e 61 74 69 6f 6e 5f 72 65 63 6f 6d 6d 65 6e 64 65 72 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 6f 73 74 63 61 72 64 73 22 3a 5b 7b 22 75 66 69 22 3a 32 30 30 32 33 34 38 38 7d 2c 7b 22 75 66 69 22 3a 32 30 30 38 38 33 32 35 7d 2c 7b 22 75 66 69 22 3a 32 30 30 37 39 31 31 30 7d 2c 7b 22 75 66 69 22 3a 32 30 30 32 34 38 30 39 7d 2c 7b 22 75 66 69 22 3a 32 30 30 31 34 31 38 31 7d 5d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: {"action_name":"webcoreux.destination_recommender_viewed","action_version":"1.0.0","content":{"postcards":[{"ufi":20023488},{"ufi":20088325},{"ufi":20079110},{"ufi":20024809},{"ufi":20014181}]},"context":{"page":{"page_referrer":"","page_url":"https://www
2024-01-15 23:16:49 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3r%2BwKUsP5kREoZxnoQzfv%2FRY9Nopq59T%2FUSV7YOADipCQB3uc3eboUyQGy7O%2BgYIRtsLrH2Kvu1zGsqPZAmIEpuFcQRicC%2FnQXsrLpxtvMTKABvcuqNkEzFd3p8%2FH6K5V9rYlvUMsYOe5jyrsalgQGM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bb7aa3b03b4300e4&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuO5hA358u5NAuKBiqBW3L_MipFChc72jY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: U-Su05Izbnu88bGJHQj9ZpKljBkElt2ISJM9CdNPOH8qn4G3h10nJw==
2024-01-15 23:16:49 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.5	50384	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1400	OUT	GET /activity;dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:49 UTC	1254	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.5	50426	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3980	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhCYiP4tlENZkCrdTtlXQqFrtlz97rqG1yD6SKEv7r%2FVWe1bjs7tU6regtsntYbq4RgN041vYOQCAJNN2s%2FOXdxiU1LFMcP%2BREVyEvV2IFCa6cu9xlmKR3l%2BNrnXvk6YKx%2B%2FuC8AX47U2RPESatHFvAYM%2BfaMxeY%2F6E%3D
2024-01-15 23:16:49 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-01-15 23:16:49 UTC	1092	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 89 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:49 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f623a3b0b847018e&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcYkjXJOsweq9stHWxcmu97M4tBvwVXSRQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 6ymJRCOVlEUV7q9ywz1YJqIyh2rNNyLSXx-quSn_Ii2fqExy3_kElQ==
2024-01-15 23:16:49 UTC	89	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 51 75 65 72 69 65 73 22 2c 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 6e 75 6c 6c 7d 7d 7d Data Ascii: {"data":{"geniusGuestData":{"__typename":"GeniusGuestQueries","signInBottomSheet":null}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.5	50429	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	2793	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga=GA1.1.810723182.1705360577; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VBnyjHBPubPUq4k7rZSdRwfhiFaAZbGrT5oVhEHpe07xsBHTb4b5%2BDgliBR1IuZRecX%2FCgmmRtGEoZLnmtihytgqjGxuidJMdZo1gc%2Fw2sSEH7gNlrdPNRUnDzpKiomryA%2FMtN8g4UZp984%2BYaUS2b0%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:16:49 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:49 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=96eca3b0667401ee&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdZwAmrtgfB2ZVKtewDlQ0NBTSUU3BwMCQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 148f45d892bd2198be5295012ed59888.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: NCnLXAfQQaO4o9F7hBXfPqulvKfSoms_Td4pRjGPzukZK4cQVXyb9Q==
2024-01-15 23:16:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.5	50430	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1024	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_IIz2dK4FKIiOPT1_TLlWCJh110njpmcKCcLaLfAgEwoSW5mM&random=246440793 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.5	50433	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	3167	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 504 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D
2024-01-15 23:16:49 UTC	504	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 31 36 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 39 39 37 30 32 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 35 39 39 37 30 36 25 32 43 31 37 30 35 33 36 30 35 39 39 38 31 30 25 32 43 31 37 30 35 33 36 30 35 39 39 38 31 30 25 32 43 31 37 30 35 33 36 30 35 39 39 38 31 30 25 32 43 31 37 30 35 33 36 30 36 30 30 30 38 36 25 32 43 31 37 30 35 33 36 30 35 39 39 38 31 33 25 32 43 31 37 30 35 33 36 30 36 Data Ascii: ref_action=index&pid=f667a3ac68470510&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=16&nts=0%2C0%2C1705360599702%2C0%2C0%2C0%2C0%2C1705360599706%2C1705360599810%2C1705360599810%2C1705360599810%2C1705360600086%2C1705360599813%2C17053606
2024-01-15 23:16:50 UTC	1030	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2FL%2BZbGnE3JqJOrbmajiPX7W3S2t3TueWG0Jt91DBEVZ0PYD9lhYLHAIIc35AxG7Uj5VMMaUX3TNiKbccKiGC8o30PtT0FazAwRq0BDvfEPOvQOl9jL5mnAdyBVYV%2F9dETRsXskEEEoENRaoPZKDQVrvkEXc9JF1NA%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f25ea3b1715106a2&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJt9sAgCH2eZ4lsYal1HzieAL5A2bBbwkQU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: S3SjFI4al-9Mtcn6m7ko2q40Gm6mldx1dpyTQG7vL8i4_WaELs1XlQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.5	50437	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1950	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360608552 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
2024-01-15 23:16:50 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:49 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1544920981167902 Date: Mon, 15 Jan 2024 23:16:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.5	50436	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	1525	OUT	GET /pagead/1p-user-list/988382855/?random=1705360607644&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZYNBEMPIrA4HrSoXQRak8eVNRjEZFwy2XdfHFzpIgHMySXsA&random=825179981&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.5	50441	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:49 UTC	681	OUT	GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5364 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:55:14 GMT ETag: "1e29d071ab764beece3862fd5d8a1fc1fc3f9b64" Content-Language: 5364 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: k9eSo3oVqTke0CiFV1085UklcOiTkkt3YN2e8holj6632w9V82Pusg== Age: 1534896
2024-01-15 23:16:50 UTC	5364	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.5	50442	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 1824 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	1824	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 72 73 2b 69 67 2b 6f 63 41 41 41 41 3a 58 48 37 33 55 43 45 64 4d 75 72 5a 30 76 49 64 79 75 73 31 74 4e 79 35 76 76 37 77 2f 6b 67 6a 39 74 4f 4f 7a 34 72 4e 47 38 4d 66 7a 79 44 34 58 4c 74 30 45 32 49 50 45 4d 61 75 79 2b 32 57 2b 59 6b 2f 34 34 75 43 65 4a 63 6b 6c 4f 31 79 30 6f 43 50 69 78 31 2f 64 77 58 35 51 7a 47 54 43 6a 45 2f 45 48 55 30 39 4d 45 4d 6d 32 65 2b 47 51 69 6b 4c 39 5a 66 36 64 4f 75 46 4f 32 51 6d 70 39 68 37 70 7a 72 43 6e 37 64 68 6b 57 42 7a 6c 67 39 6d 58 2f 41 64 64 4c 5a 4b 4c 44 7a 59 6a 70 68 58 70 53 58 46 69 4f 4d 38 39 65 32 37 50 77 6a 47 30 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0
2024-01-15 23:16:50 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 860 Connection: close Date: Mon, 15 Jan 2024 23:16:50 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce2-360103815bb350b04f6db97e X-Cache: Miss from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Oxr3PMb7rpACgz7Q7U72g8HZTNAIZm1T0ITRlu01-9JilliWoCBoVA==
2024-01-15 23:16:50 UTC	860	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6e 59 2b 6a 41 50 63 53 41 41 41 41 3a 71 75 57 66 2b 6b 2b 2f 63 42 34 58 53 39 30 52 38 68 75 59 41 6c 6b 4c 54 51 65 4b 68 50 65 30 42 62 31 36 43 48 63 4b 2b 72 55 4b 53 42 42 46 59 2b 4c 55 73 35 79 63 77 6a 2b 6a 54 77 4c 59 35 31 34 66 4c 2b 39 47 37 6b 49 6d 7a 68 48 45 5a 41 58 69 70 6f 6d 4f 7a 69 39 37 56 4d 77 36 56 65 35 6b 4b 6c 31 53 5a 62 32 34 54 33 45 58 52 57 6c 4b 47 59 33 38 64 34 61 54 76 50 59 50 31 45 69 4f 69 2b 6d 45 6b 48 55 6c 4b 5a 56 4e 6d 30 64 5a 43 77 6b 4f 62 41 70 48 49 6d 42 4a 5a 6e 51 70 63 31 76 57 4f 55 75 45 41 30 76 38 6c 6f 41 75 38 34 6f 6e 6c 7a 44 66 65 50 55 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAnY+jAPcSAAAA:quWf+k+/cB4XS90R8huYAlkLTQeKhPe0Bb16CHcK+rUKSBBFY+LUs5ycwj+jTwLY514fL+9G7kImzhHEZAXipomOzi97VMw6Ve5kKl1SZb24T3EXRWlKGY38d4aTvPYP1EiOi+mEkHUlKZVNm0dZCwkObApHImBJZnQpc1vWOUuEA0v8loAu84onlzDfePU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.5	50443	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2404 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	2404	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 70 74 6d 6a 41 4b 49 51 41 41 41 41 3a 4b 46 2f 62 6a 48 49 75 58 6c 75 39 32 30 64 6e 79 54 4b 5a 6f 51 41 4b 55 30 35 77 56 6e 72 52 54 38 2b 6f 64 71 69 46 54 68 7a 41 43 52 6d 43 77 71 35 61 45 34 34 52 2f 71 4b 33 6b 58 2b 7a 4f 73 54 7a 51 45 68 68 49 5a 31 6b 43 6b 31 64 75 70 35 46 63 2b 78 44 77 56 38 31 4e 32 43 76 61 6b 77 4b 51 68 33 73 6c 4d 2f 6b 54 71 6b 78 45 63 57 56 55 6a 6e 39 72 73 42 35 64 6c 5a 57 2f 6d 64 6c 4a 64 4e 4c 42 55 33 69 52 49 70 65 6a 58 59 59 50 61 77 47 4e 32 44 6f 6d 79 37 68 54 63 76 4b 54 6b 6e 2f 63 79 51 43 4a 4f 63 6c 6f 64 61 64 65 2f Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/
2024-01-15 23:16:50 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1036 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:50 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce2-5533b567750d1795164b3725 X-Cache: Miss from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: E2-exGehHf6OzNNv-E7DN3L8WOrP0CaWnZP6Pm_ba88M9dxZYHpHWQ==
2024-01-15 23:16:50 UTC	1036	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 76 68 6d 69 42 52 51 74 41 41 41 41 3a 65 4a 45 66 57 49 45 75 54 6e 48 65 71 50 64 52 6c 68 72 4c 6f 44 69 74 6b 65 57 61 66 51 49 70 48 75 73 30 30 4f 57 51 46 51 6f 56 59 77 4b 45 66 4a 73 6a 31 52 6a 79 34 37 62 42 6b 65 65 43 78 58 6d 72 31 4f 73 62 39 41 5a 38 74 79 32 67 65 32 53 6c 49 6c 4a 4a 63 55 54 6f 66 4a 37 4f 46 45 4a 59 7a 45 6b 6a 6a 37 35 4d 64 51 69 61 69 2b 39 36 57 46 77 57 75 48 59 71 71 5a 52 78 76 78 38 33 67 61 79 77 77 70 51 73 7a 71 7a 70 6f 35 52 4c 47 49 32 6b 6e 57 67 77 58 54 4e 35 46 36 65 59 30 70 42 4e 6c 77 52 52 71 59 67 4a 73 34 6c 75 4f 6e 68 52 49 33 72 48 30 37 66 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvhmiBRQtAAAA:eJEfWIEuTnHeqPdRlhrLoDitkeWafQIpHus00OWQFQoVYwKEfJsj1Rjy47bBkeeCxXmr1Osb9AZ8ty2ge2SlIlJJcUTofJ7OFEJYzEkjj75MdQiai+96WFwWuHYqqZRxvx83gaywwpQszqzpo5RLGI2knWgwXTN5F6eY0pBNlwRRqYgJs4luOnhRI3rH07f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.5	50444	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	681	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Fri, 22 Dec 2023 11:30:54 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 45y4PfT-uBf07ujwK9kJsudpgA0lLvm0rTPqbkDCLhFMGLQMYT8s-A== Age: 2115956
2024-01-15 23:16:50 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.5	50450	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3508	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 763 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN
2024-01-15 23:16:50 UTC	763	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 63 72 6f 6c 6c 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 73 65 65 6e 22 3a 5b 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 66 6c 69 67 68 74 73 22 2c 22 70 61 63 6b 61 67 65 73 22 2c 22 63 61 72 73 22 2c 22 63 72 75 69 73 65 73 22 2c 22 61 74 74 72 61 63 74 69 6f 6e 73 22 2c 22 61 69 72 70 6f 72 74 5f 74 61 78 69 73 22 5d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 Data Ascii: {"action_name":"webcoreux.header_component_scrolled","action_version":"1.0.0","content":{"product_verticals_seen":["accommodations","flights","packages","cars","cruises","attractions","airport_taxis"]},"context":{"page":{"page_referrer":"","page_url":"htt
2024-01-15 23:16:50 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPed6%2BD14g72cyyTCZCkoLoh92OKUTmclJErKLSc3ty%2F89y3UbNMQvQs6FrNm9eUKQ9IIlrm1vrKNqC1TenNnO4bRLicVQ7VUH6vQNo6MpXBJPIdK8hkGr8e734I1h9pMaubXfboiL750iFToY0vcyPgAf%2FVHBcN7nl0%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f3a0a3b1a9fa0079&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsth4aIQNHOqJFYD_aOCaeOs-a1BIZ788PA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Zks8HIST3YboG4Mi_vWDUysCElYSfBnxOTMT3fdq2x8c4EZtMPLd8g==
2024-01-15 23:16:50 UTC	29	IN	Data Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d Data Ascii: {"content":"Sent","status":1}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.5	50447	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	681	OUT	GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5571 Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:01:52 GMT ETag: "2daca33e79a04a025f341e9a2b6f4313d5f649c9" Content-Language: 5571 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: OwLJ5Hn30G9S1kiqwrxuhqfgmnlMmavauTS272Bool_EOmhcuzCwEw== Age: 2114098
2024-01-15 23:16:50 UTC	5571	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.5	50446	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	5262	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN
2024-01-15 23:16:50 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 36 25 32 43 33 34 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 31 25 32 43 35 25 32 43 32 37 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 31 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=6%2C34%2C2%2C9%2C7%2C1%2C5%2C27%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=1&has_open_bookings=
2024-01-15 23:16:50 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBI9EWd%2FKX1FgSFzfvOkDh0pDzLXxgZmKKMqR7KWwaCpekJ2MleDzDR%2F6YpN8t3u5hUypSgJsdd7vVAQEY83k1LehlYu8BkQcbI6Ui5PvdsEdnKdMwyDJwnUmv9I5DPG1%2BxfB6rACz1w9PFMn7AICbnyuPUqakkQaNY%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b257a3b1ee1c027e&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_ve3EbHo0ZhYQxOsUcRfIQLQ5Ujr5vTuW40 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: cXbRqYVMPJrBK59qHT6Gaoof23OxVEkLKvwW35jgNlcYvlv1YQfaEA==
2024-01-15 23:16:50 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.5	50448	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3992	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 716 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0
2024-01-15 23:16:50 UTC	716	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 47 6f 6f 67 6c 65 41 64 4c 6f 61 64 65 64 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 74 72 61 63 6b 69 6e 67 5f 69 6e 66 6f 22 3a 7b 22 6e 64 69 73 70 6c 61 79 5f 61 64 5f 69 64 22 3a 22 37 65 37 65 32 62 65 64 2d 38 36 30 64 2d 34 61 62 37 2d 61 66 65 63 2d 31 33 34 64 31 33 62 61 38 39 39 39 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 76 69 65 77 5f 69 64 22 3a 22 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 76 65 72 74 69 Data Ascii: {"operationName":"trackGoogleAdLoaded","variables":{"input":{"tracking_info":{"ndisplay_ad_id":"7e7e2bed-860d-4ab7-afec-134d13ba8999","rendered_ad_pageview_id":"f667a3ac68470510","rendered_ad_pagename":"INDEX","rendered_ad_position":"INDEX_PRIMARY","verti
2024-01-15 23:16:50 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 367 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RTu7F%2FANJcXkQlKmlOLePNYEnSK7m2Xws80h31l4aqlcLkC0rPpN5%2F%2FDsrwUTSYeaEn82QmHDGyqEkb%2FpF8E1Lx8eQUv66BT%2Frx8hLgln7Ojbz6n4xHHbAbBB2qpcdb8XtQyrRP3VE8e40iPUid0ImI%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=507ba3b111c202c9&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVOfmNXU9fNEzzsXyXuGJGhyaVbSxq_y3g x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: v-bkgEVboWmNOQp9_EG_X7E2YwB2yC05Qh9AOS0JXvCcogl3kbsIXg==
2024-01-15 23:16:50 UTC	367	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 47 6f 6f 67 6c 65 41 64 4c 6f 61 64 65 64 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 6e 61 6d 65 Data Ascii: {"data":{"trackGoogleAdLoaded":{"children":[],"childrenWithTypeReferences":{"empty":false,"children":{"appliedDirectives":[],"directives":[]},"childrenAsList":[]},"allDirectivesByName":{},"extensionDefinitions":[],"directivesByName":{},"coercing":{},"name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.5	50445	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 958 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:50 UTC	958	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 63 63 65 65 62 61 34 38 2d 34 36 63 62 2d 34 36 39 35 2d 62 39 31 66 2d 61 66 30 63 33 33 30 39 38 66 65 65 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"cceeba48-46cb-4695-b91f-af0c33098fee","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:50 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.5	50451	172.253.115.148	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 139 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	139	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 31 37 30 37 33 33 36 31 33 31 34 36 36 31 35 30 34 31 39 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"11707336131466150419"},"type":"trigger-no-matching-source"}]
2024-01-15 23:16:50 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:16:50 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.5	50452	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	2791	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360598.47.0.0; _ga_A12345=GS1.1.1705360585.1.1.1705360598.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360600023; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoArs+ig+ocAAAA:XH73UCEdMurZ0vIdyus1tNy5vv7w/kgj9tOOz4rNG8MfzyD4XLt0E2IPEMauy+2W+Yk/44uCeJcklO1y0oCPix1/dwX5QzGTCjE/EHU09MEMm2e+GQikL9Zf6dOuFO2Qmp9h7pzrCn7dhkWBzlg9mX/AddLZKLDzYjphXpSXFiOM89e27PwjG0ESGXYaSvIR2HL+HAvjvE1PNEdVrKAo0/7nUrLPHuolzk0UFzxhd/j4+rsaIWSAt+w93KA+SUPQzuPKJE7a; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLDrqm%2BGkbJ8yRpThq9yyegR%2F2EMSYE9A0USiN5OjzgwXqTFnRcMLPhB9Z1O9Gz9hCGZdbrnY9eTNdpiOxPJA3VHfmBXVLvyWMS3wGZd1hhi2lDNZic8OrHvaI6F1ZFaKQ%3D
2024-01-15 23:16:50 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bd34a3b1f51c0a7a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRVYOP0GfObYzsouF5-5r5ZTJGzRpcCDxA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: XoGmTb1ollNRDrnzCqx3MgpLwKjJlLbEFOYA-mSMubyrBcUDv-sZnQ==
2024-01-15 23:16:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.5	50455	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3867	OUT	GET /js_errors?pid=f667a3ac68470510&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e
2024-01-15 23:16:50 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1b4aa3b11817011d&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp-700bQ6GqLU6XtzT4IG89cjVJ_111IoW x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 85fc1201a1918facbeb30836e7391660.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: bDp9fUQeEhMl3zvgg1wzyaylW0bUeDUHe7KxEZuBY5ngwjcHfuvWiw==
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.5	50453	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3992	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 355 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RakSdL4mNkavLnTKl47tnKjco76SJJVt3OD3sQhJbAvjMsfNM02XHGkFFPNz%2FtLUyQMAt03wqEbJ1uBoWkaKE0DNptRY0%2BL4H4Qa5%2FS84%2B6VOVT9BSIj4jjbu9rVVX%2FYPrcqOfH%2BpX%2FwDMnU%2BqRInpM%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0
2024-01-15 23:16:50 UTC	355	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 72 65 6e 64 65 72 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 36 35 37 35 30 39 33 34 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_rendered","campaign_id":"3265750934","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":
2024-01-15 23:16:50 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UHzjYnZGn16VCX5L2NGxtiSjr42O6nuy2scgYbEUwaEsOMudjJjOTGQA9z7pibIMlBVPgg4t2G7BVY0S%2BSP4ZHL1F9wngO%2FeIZDcfRjd%2BEhh1vd0x2qXM9gmI3072msR3YMICPT9WhT9vc%2FUc0jV56XDywMcEeJBA%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=57b0a3b1bfd20032&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGQ5MGf2w4XI0zk18uI4d2A9DmnCVGIADLg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: cTCd87hegKTrnDoA8YpdNehIf6xj2qG28gHYQuX9MQDX34PoBJ3V2Q==
2024-01-15 23:16:50 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 7d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 Data Ascii: {"data":{"trackAdStatus":{"childrenWithTypeReferences":{"children":{"directives":[],"appliedDirectives":[]},"childrenAsList":[],"empty":false},"description":"A JSON scalar","name":"JSON","coercing":{},"appliedDirectives":[],"children":[],"allAppliedDirect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.5	50454	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	1965	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360607860&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_J8dQ19nhGyvWNr45DULlOEUF2EILMmfQIlWNIQk6BYSaIomx&random=3820176364&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.5	50458	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	1525	OUT	GET /pagead/1p-user-list/973712236/?random=1705360607901&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_3_cmDTS6kBH18CikhtE2wR7f3jd-lCUKV-yZpnqyl1fnNZHS&random=2600041176&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.5	50459	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	686	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 14:48:53 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NvTamUwEqQwgz5bbg4CCqwmINyCH3-3R0YdbTlGxBJ15nVLI_aOAjw== Age: 2104077
2024-01-15 23:16:50 UTC	9596	IN	Data Raw: 32 35 37 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2574JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:50 UTC	676	IN	Data Raw: 32 39 64 0d 0a 08 1a f2 ea 35 88 95 c9 c9 2b fd de f9 ae ea 08 d6 38 95 47 40 31 55 14 4b 22 bb b8 8e ce d2 5b 89 4e 12 35 2c df 85 78 ae a9 77 71 a8 ea 13 dd ca 1c 34 8c 4e 37 7d d1 d8 7e 55 da 78 f7 5c 42 cb a5 45 24 58 18 69 c3 12 79 ea 07 1f 9f e5 5c 11 31 67 9f b3 7e 11 b1 ae 98 47 4b 9c 95 67 77 64 42 55 87 73 ff 00 7f 68 08 e7 fb df f7 f2 a4 de 9f de 83 fe fc b5 34 b2 1e 33 6d f8 a3 56 96 32 b8 08 df 3d 1f fe fa a3 63 ff 00 b5 ff 00 7d d2 86 8d 47 fc bb 7f df 0c 7f ad 29 92 33 fc 56 df f7 e9 a8 00 c3 a8 e4 b0 ff 00 b6 d8 a4 08 fc 13 bb fe fe d2 99 53 a6 e8 31 ed 13 52 f9 b1 91 f7 ed ff 00 ef c3 50 17 02 8e 7a 6f fc 25 06 94 23 8e bb c7 fd b5 c5 37 7c 78 fb d6 c7 eb 0b 53 d6 48 c1 fb d6 ff 00 84 0c 68 01 08 1d 0b 27 fc 0a e0 1a 6e d4 ff 00 a6 27 f1 Data Ascii: 29d5+8G@1UK"[N5,xwq4N7}~Ux\BE$Xiy\1g~GKgwdBUsh43mV2=c}G)3VS1RPzo%#7\|xSHh'n'
2024-01-15 23:16:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.5	50457	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	1522	OUT	GET /pagead/1p-user-list/973712236/?random=1705360607937&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Fi636anKBXpCOS77ajXhwCig1tEr1GRkc0CPKwqLRhck4F8G&random=4885263&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.5	50461	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	2828	OUT	GET /logo?ver=1&sid=0059242d4bafbe759210d4ea3ea582cb&t=17053606001 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; lastSeen=1705360609643
2024-01-15 23:16:50 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Tue, 16-Jan-2024 23:16:50 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=eb58a3b136b9035e&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzVd2AsUdOWnGw3ULfDFnmUX6dNSzUMg-F x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Hds3oM0dn_5TU9MKPmQIVhKNB78zBFD6LUJs9DHE9erO6bP3wWSQMA==
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.5	50456	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	1525	OUT	GET /pagead/1p-user-list/975716499/?random=1705360607982&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZNtCHK4WSUyPlt65YjyJIGPKlUPsYbV0cbaC5ylbAyBog22y&random=2403716807&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.5	50464	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3280	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; lastSeen=1705360609643
2024-01-15 23:16:50 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7d24a3b1b8e50481&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejICBFN4GbzOBZn9fCNFkGVphSsusfa_Mko x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 3LKGooA4o92xUc8UjOxTmZhiuwcv4s8hE4lv1CqWjyGOU6TY3CYmaw==
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.5	50465	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	686	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 16:09:20 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 6gNBYqyPwWFlA2DwioNpS7jSJB6nkEppNJ5g571K6FcOBC4m7hpvHg== Age: 2099250
2024-01-15 23:16:50 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:16:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.5	50462	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	421	OUT	GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:50 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 226735 Connection: close Server: nginx Date: Tue, 02 Jan 2024 15:56:08 GMT Last-Modified: Wed, 10 Apr 2019 11:21:48 GMT ETag: "5cadd1cc-375af" Expires: Thu, 01 Feb 2024 15:56:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: raqO22er0cPJHWtzKb2X8jf2jTEpdeT4iefRaV39RuGoLcxlk10Zlw== Age: 1149642
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 62 6f 6f 6b 69 6e 67 2d 69 63 6f 6e 73 65 74 27 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 66 6f 6e 74 2d 77 6f 66 66 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 64 30 39 47 52 67 41 42 41 41 41 41 41 70 65 34 41 41 77 41 41 41 41 43 6c 32 67 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 48 55 31 56 43 41 41 41 42 48 41 41 41 4b 4e 77 41 41 43 6a 63 4e 51 77 38 53 55 39 54 4c 7a 49 41 41 43 6e 34 41 41 41 41 59 41 41 41 41 47 41 50 45 67 65 37 59 32 31 68 63 41 41 41 4b 6c 67 41 41 41 48 4d 41 41 41 42 7a 4e 66 46 48 6c 68 6e 59 58 4e 77 41 Data Ascii: @font-face { font-family: 'booking-iconset'; src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwA
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 34 42 42 77 34 42 46 79 4d 2b 41 54 63 2b 41 54 63 2b 41 54 63 2b 41 54 4d 79 46 68 63 65 41 52 63 65 41 52 63 65 41 52 55 55 42 67 63 4f 41 51 63 56 48 67 45 58 48 67 45 56 46 41 59 45 31 77 39 46 4a 50 78 53 4a 45 55 50 44 52 51 50 42 77 63 50 46 41 30 50 52 53 51 42 57 41 4a 57 4a 45 55 50 44 52 51 50 42 77 63 50 46 41 33 39 53 31 6c 57 58 49 56 36 58 6b 6c 4e 57 6e 69 48 58 51 47 33 42 78 49 4d 44 42 6f 51 44 79 41 52 46 53 51 51 44 78 6f 4b 43 78 41 46 42 51 59 42 54 67 45 4c 43 77 77 69 46 78 4d 68 44 51 30 4e 42 67 55 47 44 67 6b 49 46 41 73 4c 46 77 77 4b 45 77 6b 4b 45 51 63 49 44 41 55 45 42 51 73 4b 43 68 73 51 43 68 49 49 42 77 30 45 42 51 67 43 41 77 49 42 54 67 45 47 42 67 59 51 43 67 6f 59 44 67 38 67 45 67 34 62 44 67 30 59 43 77 73 52 42 Data Ascii: 4BBw4BFyM+ATc+ATc+ATc+ATMyFhceARceARceARUUBgcOAQcVHgEXHgEVFAYE1w9FJPxSJEUPDRQPBwcPFA0PRSQBWAJWJEUPDRQPBwcPFA39S1lWXIV6XklNWniHXQG3BxIMDBoQDyARFSQQDxoKCxAFBQYBTgELCwwiFxMhDQ0NBgUGDgkIFAsLFwwKEwkKEQcIDAUEBQsKChsQChIIBw0EBQgCAwIBTgEGBgYQCgoYDg8gEg4bDg0YCwsRB
2024-01-15 23:16:50 UTC	5608	IN	Data Raw: 6f 53 4b 52 67 42 49 79 73 72 4c 6a 41 59 4c 78 67 44 4d 67 73 4c 4e 43 6f 70 44 67 63 57 4a 78 49 43 54 67 38 51 4a 68 41 51 47 2f 45 6d 61 58 56 33 4e 44 51 2b 45 68 6f 6d 4a 57 70 31 64 7a 51 7a 50 78 49 62 2f 72 67 77 54 7a 51 58 43 51 67 7a 53 6c 73 78 4d 45 38 30 46 77 67 4a 4d 30 70 62 4d 51 46 59 4d 52 73 32 47 77 67 74 43 51 73 30 4b 69 6f 4f 43 42 55 6d 45 51 6c 45 44 52 41 6e 45 42 41 61 50 41 4d 42 41 77 45 34 43 77 73 43 45 78 4d 7a 54 67 38 6d 46 51 49 69 4b 69 73 75 4d 77 45 5a 4e 42 6b 32 43 77 77 30 4b 53 6f 4e 43 42 63 71 45 77 4e 4b 44 78 41 6d 44 78 41 62 50 67 49 42 41 77 51 31 43 67 73 44 45 78 49 7a 54 68 45 6e 46 67 55 42 41 53 4d 72 4b 79 31 4a 4e 44 38 53 47 79 55 6d 61 58 56 33 4e 44 51 2b 45 78 73 6d 4a 57 6c 31 65 41 46 73 43 Data Ascii: oSKRgBIysrLjAYLxgDMgsLNCopDgcWJxICTg8QJhAQG/EmaXV3NDQ+EhomJWp1dzQzPxIb/rgwTzQXCQgzSlsxME80FwgJM0pbMQFYMRs2GwgtCQs0KioOCBUmEQlEDRAnEBAaPAMBAwE4CwsCExMzTg8mFQIiKisuMwEZNBk2Cww0KSoNCBcqEwNKDxAmDxAbPgIBAwQ1CgsDExIzThEnFgUBASMrKy1JND8SGyUmaXV3NDQ+ExsmJWl1eAFsC
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 49 47 46 51 55 79 4e 6a 55 30 4a 69 4d 68 46 53 45 42 46 53 45 69 42 68 55 55 46 6a 4d 68 46 52 51 57 4f 77 45 79 4e 6a 30 42 4e 43 59 72 41 53 49 47 46 51 55 79 4e 6a 55 30 4a 69 73 42 46 51 45 56 49 79 49 47 46 52 51 57 4f 77 45 56 46 42 59 37 41 54 49 32 50 51 45 30 4a 69 73 42 49 67 59 56 42 54 49 32 4e 54 51 6d 49 79 45 56 39 70 38 68 4c 69 34 68 6e 78 49 4e 46 77 30 53 45 67 30 58 44 52 49 43 63 79 45 75 4c 69 48 2b 50 51 48 44 2f 75 58 2b 43 53 45 75 4c 69 45 42 39 78 4d 4d 47 41 77 53 45 67 77 59 44 42 4d 42 47 79 45 75 4c 69 46 72 2f 6b 4c 70 49 53 34 75 49 65 6b 53 44 52 63 4e 45 68 49 4e 46 77 30 53 41 69 6b 68 4c 69 34 68 2f 6f 62 58 4c 53 34 68 49 53 38 73 44 52 49 53 44 66 67 4e 45 68 49 4e 7a 43 38 68 49 53 36 65 41 6a 41 74 4c 69 45 68 4c Data Ascii: IGFQUyNjU0JiMhFSEBFSEiBhUUFjMhFRQWOwEyNj0BNCYrASIGFQUyNjU0JisBFQEVIyIGFRQWOwEVFBY7ATI2PQE0JisBIgYVBTI2NTQmIyEV9p8hLi4hnxINFw0SEg0XDRICcyEuLiH+PQHD/uX+CSEuLiEB9xMMGAwSEgwYDBMBGyEuLiFr/kLpIS4uIekSDRcNEhINFw0SAikhLi4h/obXLS4hIS8sDRISDfgNEhINzC8hIS6eAjAtLiEhL
2024-01-15 23:16:50 UTC	9475	IN	Data Raw: 51 41 41 41 45 79 4e 6a 55 30 4a 69 4d 69 42 68 55 55 46 6a 4d 54 4a 67 59 48 42 69 59 6e 4a 54 49 32 4e 7a 34 42 4e 7a 34 42 4e 7a 34 42 4e 7a 34 42 4e 7a 34 42 4e 7a 59 6d 4a 79 55 6d 42 67 38 42 42 68 59 66 41 52 59 47 44 77 45 4f 41 52 63 6c 4a 67 59 48 42 68 59 58 41 52 34 42 4d 7a 49 32 4e 7a 59 6d 41 52 63 33 48 77 45 77 46 6a 63 58 46 52 51 57 48 77 45 57 4e 6a 63 32 4a 69 38 42 4c 67 45 31 4d 43 59 33 50 67 45 78 4d 43 59 6e 4a 67 59 48 4a 7a 63 6e 42 79 63 58 42 77 50 54 4a 7a 67 34 4a 79 63 34 4f 43 64 65 43 68 67 48 4d 32 51 4a 2f 6f 34 4a 45 51 63 45 43 51 51 4b 46 41 6f 4e 47 67 77 4d 47 41 30 52 4a 42 41 4f 42 68 50 2b 2f 52 4d 76 44 78 45 50 42 68 50 44 44 41 51 44 6a 51 77 43 43 76 35 6d 43 78 63 48 42 67 59 4b 41 7a 77 4d 4a 42 59 6d 57 Data Ascii: QAAAEyNjU0JiMiBhUUFjMTJgYHBiYnJTI2Nz4BNz4BNz4BNz4BNz4BNzYmJyUmBg8BBhYfARYGDwEOARclJgYHBhYXAR4BMzI2NzYmARc3HwEwFjcXFRQWHwEWNjc2Ji8BLgE1MCY3PgExMCYnJgYHJzcnBycXBwPTJzg4Jyc4OCdeChgHM2QJ/o4JEQcECQQKFAoNGgwMGA0RJBAOBhP+/RMvDxEPBhPDDAQDjQwCCv5mCxcHBgYKAzwMJBYmW
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 51 45 42 41 51 45 43 41 51 49 42 41 51 45 43 41 51 45 42 41 51 45 43 41 51 49 42 41 67 45 42 34 76 67 36 61 53 6b 42 41 51 49 42 41 67 45 42 41 67 45 43 41 51 45 42 41 67 45 42 41 51 45 42 41 67 45 43 41 51 48 6a 41 51 45 42 41 51 45 42 41 51 49 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 49 42 4c 6a 6f 48 48 30 4d 6b 41 65 45 77 57 31 52 4c 49 41 51 44 41 77 4d 45 41 77 50 2b 72 51 45 43 52 53 77 30 41 67 45 4c 43 77 45 43 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 43 41 51 45 42 41 51 45 43 41 51 45 42 41 51 45 42 41 51 45 42 41 67 45 42 41 51 49 42 4c 51 49 70 49 77 45 43 41 51 49 42 41 51 45 42 41 51 45 42 41 51 49 42 41 67 45 42 41 51 45 43 41 64 4d 42 41 67 45 42 41 51 49 42 41 51 49 42 41 67 45 42 41 51 49 42 41 67 45 42 41 6a 65 48 Data Ascii: QEBAQECAQIBAQECAQEBAQECAQIBAgEB4vg6aSkBAQIBAgEBAgECAQEBAgEBAQEBAgECAQHjAQEBAQEBAQIBAQEBAQEBAQEBAQIBLjoHH0MkAeEwW1RLIAQDAwMEAwP+rQECRSw0AgELCwECAQEBAQEBAQEBAQEBAQECAQEBAQECAQEBAQEBAQEBAgEBAQIBLQIpIwECAQIBAQEBAQEBAQIBAgEBAQECAdMBAgEBAQIBAQIBAgEBAQIBAgEBAjeH
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 54 53 68 55 54 5a 52 4e 31 46 52 41 41 41 41 41 77 41 41 2f 38 41 47 43 77 50 41 41 43 38 41 58 51 43 4c 41 41 41 6c 48 41 45 78 46 41 59 6a 49 53 49 6d 4e 54 41 30 4e 54 51 32 4e 7a 34 44 4e 7a 55 75 41 54 55 38 41 54 45 30 4e 6a 4d 79 46 68 30 42 46 41 59 48 46 52 34 44 46 78 34 42 46 53 55 2b 41 7a 63 75 41 53 63 31 50 67 45 39 41 54 51 6d 49 79 49 47 46 54 41 55 46 52 51 57 46 78 55 4f 41 77 63 4f 41 52 55 63 41 54 45 55 46 6a 73 42 50 67 45 33 4d 53 55 75 41 79 63 31 50 67 45 39 41 54 51 6d 49 79 49 47 46 54 41 55 46 52 51 57 46 78 55 4f 41 51 63 65 41 78 63 65 41 52 63 7a 4d 6a 59 31 4d 44 51 31 4e 43 59 6e 4d 51 55 52 42 77 58 38 41 67 55 49 45 78 73 4c 54 47 46 6b 49 68 55 59 5a 6d 64 6d 5a 68 67 56 4a 57 52 67 53 77 73 62 45 76 77 41 43 7a 31 52 Data Ascii: TShUTZRN1FRAAAAAwAA/8AGCwPAAC8AXQCLAAAlHAExFAYjISImNTA0NTQ2Nz4DNzUuATU8ATE0NjMyFh0BFAYHFR4DFx4BFSU+AzcuASc1PgE9ATQmIyIGFTAUFRQWFxUOAwcOARUcATEUFjsBPgE3MSUuAyc1PgE9ATQmIyIGFTAUFRQWFxUOAQceAxceARczMjY1MDQ1NCYnMQURBwX8AgUIExsLTGFkIhUYZmdmZhgVJWRgSwsbEvwACz1R
2024-01-15 23:16:50 UTC	16384	IN	Data Raw: 67 45 77 45 42 38 51 44 78 38 51 41 51 4d 43 41 77 49 54 4b 42 4d 43 42 51 49 4a 45 77 73 57 4e 52 59 4b 42 77 59 42 41 77 48 35 44 67 34 4f 4b 41 36 53 4b 51 6b 51 43 41 49 42 46 79 77 58 44 42 6b 4d 44 67 51 51 45 43 6b 4f 45 43 45 51 47 6a 51 62 42 67 67 43 42 51 6f 46 41 51 49 42 41 67 49 42 48 6a 30 66 41 67 45 43 48 78 51 56 48 41 45 42 41 51 45 46 42 78 38 2f 48 77 49 42 42 67 73 47 41 51 45 42 41 51 45 42 43 42 49 4a 42 52 45 4d 47 54 49 61 44 42 6b 4d 45 68 73 43 41 78 51 52 41 78 59 79 49 79 4d 79 4d 69 4d 6a 4d 76 37 6e 41 77 55 44 41 67 59 44 41 67 45 44 42 77 4d 6f 55 43 6b 44 43 41 4d 4b 44 77 63 4d 42 41 30 46 42 67 63 43 41 51 45 42 2b 51 34 6f 44 67 34 4f 6b 72 49 75 58 43 34 43 41 77 49 62 4e 68 73 50 48 51 38 51 4b 51 34 4e 41 78 41 54 Data Ascii: gEwEB8QDx8QAQMCAwITKBMCBQIJEwsWNRYKBwYBAwH5Dg4OKA6SKQkQCAIBFywXDBkMDgQQECkOECEQGjQbBggCBQoFAQIBAgIBHj0fAgECHxQVHAEBAQEFBx8/HwIBBgsGAQEBAQEBCBIJBREMGTIaDBkMEhsCAxQRAxYyIyMyMiMjMv7nAwUDAgYDAgEDBwMoUCkDCAMKDwcMBA0FBgcCAQEB+Q4oDg4OkrIuXC4CAwIbNhsPHQ8QKQ4NAxAT
2024-01-15 23:16:50 UTC	14808	IN	Data Raw: 53 6f 55 46 43 6f 56 46 69 63 53 45 68 34 4c 44 41 77 4d 44 41 73 65 45 68 49 6e 46 68 55 71 46 42 51 71 41 41 45 41 41 50 2f 41 42 41 41 44 77 41 41 54 41 41 41 42 46 41 34 43 49 79 49 75 41 6a 55 30 50 67 49 7a 4d 68 34 43 42 41 42 51 69 37 74 71 61 72 75 4c 55 46 43 4c 75 32 70 71 75 34 74 51 41 63 42 71 75 34 74 51 55 49 75 37 61 6d 71 37 69 31 42 51 69 37 73 41 41 41 41 41 41 51 41 4b 2f 38 59 45 4a 67 4f 77 41 43 67 41 41 41 45 32 4d 68 63 54 48 67 45 7a 49 54 49 57 42 77 55 4f 41 52 63 54 46 67 59 6e 4a 53 59 69 42 77 55 47 4a 6a 63 54 4e 69 59 6e 4a 53 59 32 4d 79 45 79 4e 6a 63 54 41 67 30 46 44 41 56 74 42 52 73 4f 41 57 45 50 42 41 7a 2b 34 67 77 4b 42 57 30 45 43 67 7a 2b 34 67 73 69 43 2f 37 69 44 41 6f 45 62 51 55 4b 44 50 37 69 44 41 51 50 Data Ascii: SoUFCoVFicSEh4LDAwMDAseEhInFhUqFBQqAAEAAP/ABAADwAATAAABFA4CIyIuAjU0PgIzMh4CBABQi7tqaruLUFCLu2pqu4tQAcBqu4tQUIu7amq7i1BQi7sAAAAAAQAK/8YEJgOwACgAAAE2MhcTHgEzITIWBwUOARcTFgYnJSYiBwUGJjcTNiYnJSY2MyEyNjcTAg0FDAVtBRsOAWEPBAz+4gwKBW0ECgz+4gsiC/7iDAoEbQUKDP7iDAQP
2024-01-15 23:16:50 UTC	1576	IN	Data Raw: 77 41 58 41 41 41 42 4d 68 34 43 46 52 51 4f 41 69 4d 69 4c 67 49 31 4e 44 34 43 41 77 6b 42 45 51 49 41 61 72 75 4c 55 46 43 4c 75 32 70 71 75 34 74 51 55 49 75 37 47 51 46 47 2f 72 6f 44 77 46 43 4c 75 32 70 71 75 34 74 51 55 49 75 37 61 6d 71 37 69 31 44 38 77 41 46 41 41 55 44 39 67 41 41 48 41 41 44 2f 77 41 4e 6f 41 38 41 41 44 77 42 41 41 46 6b 41 61 51 42 31 41 49 45 41 6b 51 41 41 41 53 45 69 42 68 55 52 46 42 59 7a 49 54 49 32 4e 52 45 30 4a 67 45 56 46 41 59 72 41 52 55 55 42 69 4d 69 4a 6a 30 42 49 79 49 6d 50 51 45 77 4e 44 30 42 4e 44 59 7a 4d 68 59 64 41 54 4d 31 4e 44 59 7a 4d 68 59 64 41 54 4d 31 4e 44 59 7a 4d 68 59 64 41 54 45 58 46 41 59 6a 49 69 59 39 41 53 4d 69 4a 6a 30 42 50 41 45 78 50 51 45 30 4e 6a 4d 79 46 68 55 52 45 79 45 69 Data Ascii: wAXAAABMh4CFRQOAiMiLgI1ND4CAwkBEQIAaruLUFCLu2pqu4tQUIu7GQFG/roDwFCLu2pqu4tQUIu7amq7i1D8wAFAAUD9gAAHAAD/wANoA8AADwBAAFkAaQB1AIEAkQAAASEiBhURFBYzITI2NRE0JgEVFAYrARUUBiMiJj0BIyImPQEwND0BNDYzMhYdATM1NDYzMhYdATM1NDYzMhYdATEXFAYjIiY9ASMiJj0BPAExPQE0NjMyFhUREyEi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.5	50466	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3986	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W74EpfapDQ8O5vI6qUq1JxLl1DE6%2FpNxgFqjI7qH00W99RzzXHYTmXWqL26Qww5kxVO9mkIt1eN8%2FAVbfojzdLcNBePUxQWlf5yHH9J4ruDb0mX8REKFPtOm0ybb4oRRi1%2Faq8xkjaZWWvmPR4FSYDCHVc%2BCIZVyA%3D
2024-01-15 23:16:50 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-01-15 23:16:51 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VMqmqEE1OmCHHnUXJaRUDgbesI5l%2FuE5CahsgzBYbuFOtTjKWjKmQPuo9wmhL8%2BJ7ZGLKQITO5CTboKAdJfSjXlJGlE%2F7oHPIYG4wedh1RdL40dQUQiM8k6%2Blo6aXJJ0cBaMSpKzyVLbVTmIGMz6BDg%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1337a3b169200038&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGa65MnEJp_ZJGhyUruI4gs36icDOW3a0qw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: o2W8vBdQYTMjnOVjPQXsjm9Eug9d94lulI7tCCmb9iIfvd_ol1gFpw==
2024-01-15 23:16:51 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 Data Ascii: {"data":{"trackAdStatus":{"childrenWithTypeReferences":{"empty":false,"childrenAsList":[],"children":{"directives":[],"appliedDirectives":[]}},"coercing":{},"extensionDefinitions":[],"allDirectivesByName":{},"name":"JSON","appliedDirectives":[],"directive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.5	50467	151.101.64.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	2154	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360609076&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZCaFFmbWJTcEtwcUNpMEcwRHZEeFJ4bkhqejNLWGZ4cjZwUDJ5bmo3RkpQOU9RU0RUdytLR01XaGM0bTZ4bGU1UklLbzVIdE5na21sQnB1K1NNd0YvZmxtcWFEbWVWdW5EVkZzUThqT2hMYz0mZUQrN0JDSm1EY2oxR3N6RktPS3pTYk9mc3k0PQ=="
2024-01-15 23:16:50 UTC	915	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:16:50 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZXTFBiREo4dERVd1VxTFdBYW9GaDJTVUtKV3BURHhmSVJiNVJLUkNXS3U0Y3E2L2d3R2s0MWRhN01TeUkxYVdhb1FIVTQxNXZ0KzFxdGJCdTJlM1BsSnFIeDgyWFppSTViTjBFYlMxb3dvUT0meWpoU2dmUkR5Q3Fxc3I1SVBZYkFDMlI0Tlg4PQ=="; Expires=Tue, 14 Jan 2025 23:16:50 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 16 referrer-policy: origin x-pinterest-rid: 1116598055118524 Date: Mon, 15 Jan 2024 23:16:50 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
636	192.168.2.5	50468	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	726	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1089 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:50 UTC	1089	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 62 64 63 66 34 38 64 30 2d 63 35 31 36 2d 34 65 32 31 2d 62 39 66 63 2d 32 35 36 64 34 38 64 36 30 64 31 31 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"bdcf48d0-c516-4e21-b9fc-256d48d60d11","ss":"1a065792-be81-49f6-b178-47e74a8775d1","df":true,"s
2024-01-15 23:16:50 UTC	388	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.5	50472	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	2789	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXboGSkx5EXM1%2FfPGY04QqOBKwS3ZmDeqvGpTERoWXnPfxx0UoyDhfJsZTb2nnptr7uzR3lrJys4VbKnZALrrjMD5VtoxXDKJD3G%2BUD%2FcSypr6O1ZbhUQ2fqA4ubiZLe9ULw7RufIF1YM22FUHcYcEYXE%3D; lastSeen=1705360609643
2024-01-15 23:16:50 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=27a3a3b1938b0002&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZq7Y_KRgjEBKrh6tm-lOc5Y1zasAYwAGQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: kdhMaxjCj-vBxmPkIPqsGUuoCphdqdvisYaRCklINg_FbE7AqfJG3w==
2024-01-15 23:16:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.5	50473	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3396	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 5542 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZZRnyta7NuJD2zcz X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVkD%2FkZDN%2FWh7Bk8HegJOxwYc5nTD48G26ELnzdYwuGjJ1ucSfNkSVsVzIzhyU%2BB8eo9g13lr4U6Zs2LLapqrrEcqLyMrGoxn3zm2ODa6EVsz8kivXyODTY%3D
2024-01-15 23:16:50 UTC	5542	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 5a 52 6e 79 74 61 37 4e 75 4a 44 32 7a 63 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 5a 52 6e 79 74 61 37 4e 75 4a 44 32 7a 63 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 5a 5a 52 6e 79 74 61 37 4e 75 4a 44 32 7a 63 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryZZRnyta7NuJD2zczContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryZZRnyta7NuJD2zczContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryZZRnyta7NuJD2zczContent-Disposition
2024-01-15 23:16:50 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=359fa3b121ab0057&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp1Gykbw__UCqKIO-yhaaC35GsFfvOlGaV x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: rt18Lqox-gW1XIsS5JCXU_vJbNU-W0dlP9p3Qq-Zw_xijacoRz9hhg==
2024-01-15 23:16:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.5	50471	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	725	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8676 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:50 UTC	8676	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 65 65 37 30 62 61 66 35 2d 32 66 30 62 2d 34 30 34 37 2d 61 36 66 66 2d 31 37 32 64 30 65 65 31 64 31 37 61 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"ee70baf5-2f0b-4047-a6ff-172d0ee1d17a","ss":"1a065792-be81-49f6-b178-47e74a8775d1","df":true,"s
2024-01-15 23:16:50 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.5	50469	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	1524	OUT	GET /pagead/1p-user-list/975716499/?random=1705360608028&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_skkIMrKrw64NPaZLdqxbfgN8fxv98XASgUy2qZDzVc3AA1y7&random=237176101&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:50 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:16:50 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.5	50474	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3396	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 5542 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBXGEr00dHQMHmO0f X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVkD%2FkZDN%2FWh7Bk8HegJOxwYc5nTD48G26ELnzdYwuGjJ1ucSfNkSVsVzIzhyU%2BB8eo9g13lr4U6Zs2LLapqrrEcqLyMrGoxn3zm2ODa6EVsz8kivXyODTY%3D
2024-01-15 23:16:50 UTC	5542	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 58 47 45 72 30 30 64 48 51 4d 48 6d 4f 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 58 47 45 72 30 30 64 48 51 4d 48 6d 4f 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 58 47 45 72 30 30 64 48 51 4d 48 6d 4f 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryBXGEr00dHQMHmO0fContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryBXGEr00dHQMHmO0fContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryBXGEr00dHQMHmO0fContent-Disposition
2024-01-15 23:16:51 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f093a3b1abd50045&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpUrUaEYoGRIQrMtbXV2HYs9B5VUkaox8m x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 0SSNJX7N0ZRTfatFp--wAqJRZ4KTqZRQUndd9IIw8LJjRQGBCz5sng==
2024-01-15 23:16:51 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.5	50475	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3396	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 5542 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryK6samBiI8eIsfVQE X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAjNqim/YaAAAA:42FX6GESMJsdz7LmZATGxEzm46ZAQWSGlx0SiCgmmutl1/mUMPeMDeLXvXhgigpr33VN5QbbjKHVESCaK9JfVvN4eEoe4Q6DIvtVtPikbZ2ZMcHL1GkX26QzU2qMaVSwPUE3IA3NfbIwIwTZ0U7D9gYF3Bqi0HA8bYT0jDOocZEI80Kp1At0U8M4C8qimjJ7rRSsIX/a5wqT369Ec6KNeWAIgAUKI1c/6gqfqBiI7SpjAYeBVoRD5Heb12jTS1J9JYofM1XN; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVkD%2FkZDN%2FWh7Bk8HegJOxwYc5nTD48G26ELnzdYwuGjJ1ucSfNkSVsVzIzhyU%2BB8eo9g13lr4U6Zs2LLapqrrEcqLyMrGoxn3zm2ODa6EVsz8kivXyODTY%3D
2024-01-15 23:16:50 UTC	5542	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 36 73 61 6d 42 69 49 38 65 49 73 66 56 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 41 70 6f 6c 6c 6f 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 36 73 61 6d 42 69 49 38 65 49 73 66 56 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 4b 36 73 61 6d 42 69 49 38 65 49 73 66 56 51 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: ------WebKitFormBoundaryK6samBiI8eIsfVQEContent-Disposition: form-data; name="error"ApolloError------WebKitFormBoundaryK6samBiI8eIsfVQEContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryK6samBiI8eIsfVQEContent-Disposition
2024-01-15 23:16:51 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:50 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f0f1a3b1f3770070&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpUrUaEYoGRISoSfJ9gVIssLQHBFPOIFr5 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 baddfcb4f2a6876b4fcc03bcd62427ee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: xbpN6A0y9J-JD66DUvTiXxC1srPw7CPOA0GrqKXAQlbJwmeMKAGrdw==
2024-01-15 23:16:51 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.5	50477	13.32.151.4	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	2310	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 1931 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCq3ZfUnAWn8RTu7F%2FANJcXkQlKmlOLePNYEnSK7m2Xws80h31l4aqlcLkC0rPpN5%2F%2FDsrwUTSYeaEn82QmHDGyqEkb%2FpF8E1Lx8eQUv66BT%2Frx8hLgln7Ojbz6n4xHHbAbBB2qpcdb8XtQyrRP3VE8e40iPUid0ImI%3D
2024-01-15 23:16:50 UTC	1931	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 36 30 37 31 37 39 2d 34 30 34 33 37 37 36 34 39 37 36 39 38 22 2c 22 76 61 6c 75 65 22 3a 39 37 38 2e 33 39 39 39 39 39 39 39 39 39 39 34 32 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 36 30 37 31 38 30 2d 35 34 33 32 38 39 31 33 35 30 35 35 30 22 2c 22 76 61 6c 75 65 22 3a 33 30 30 36 2e 36 39 39 39 39 39 39 39 39 39 38 32 35 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 35 33 36 30 36 30 37 33 38 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1705360607179-4043776497698","value":978.3999999999942,"navigationType":"navigate"},"fcp":{"id":"v3-1705360607180-5432891350550","value":3006.6999999999825,"navigationType":"navigate"},"cls":{"id":"v3-170536060738
2024-01-15 23:16:51 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Mon, 15 Jan 2024 23:16:51 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 077f711c23b8630fba0cd55c24dd3124.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C2 X-Amz-Cf-Id: p-BnGPiUVOiATafOQU9w5T64Eo3_dHVkbYN4REmcOSJTr-NCdPAsMA==
2024-01-15 23:16:51 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.5	50478	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	725	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1216 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:50 UTC	1216	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 33 36 37 65 63 62 39 39 2d 37 34 30 30 2d 34 30 34 30 2d 61 64 37 35 2d 62 64 37 37 66 64 63 63 30 61 36 32 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"367ecb99-7400-4040-ad75-bd77fdcc0a62","ss":"1a065792-be81-49f6-b178-47e74a8775d1","sh":1024,"s
2024-01-15 23:16:51 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.5	50479	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	3726	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; lastSeen=1705360608342; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiVkD%2FkZDN%2FWh7Bk8HegJOxwYc5nTD48G26ELnzdYwuGjJ1ucSfNkSVsVzIzhyU%2BB8eo9g13lr4U6Zs2LLapqrrEcqLyMrGoxn3zm2ODa6EVsz8kivXyODTY%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAptmjAKIQAAAA:KF/bjHIuXlu920dnyTKZoQAKU05wVnrRT8+odqiFThzACRmCwq5aE44R/qK3kX+zOsTzQEhhIZ1kCk1dup5Fc+xDwV81N2CvakwKQh3slM/kTqkxEcWVUjn9rsB5dlZW/mdlJdNLBU3iRIpejXYYPawGN2Domy7hTcvKTkn/cyQCJOclodade/E/rLBb7YGyLBGbO6qwmLI8YvgtVwVeiIY7rnp51qLjqHRT9oeNSlPup8j0DyhRba387eQEO7WBStJagWbU
2024-01-15 23:16:51 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:51 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ea59a3b12abd017c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLHKoV538NkDWbZKJxdEEkqm8dQ3z7JO6w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 84Gxgbq8TfuxfKLG2bXfjc39LrmipQJCXL8k6FOZ1_37A8Dgio3I9g==
2024-01-15 23:16:51 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.5	50480	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:50 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 955 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:50 UTC	955	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 39 65 39 65 35 30 38 37 2d 30 30 36 36 2d 34 63 36 65 2d 38 33 39 35 2d 62 61 65 64 61 36 61 33 33 63 39 33 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"9e9e5087-0066-4c6e-8395-baeda6a33c93","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:51 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.5	50481	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 956 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:51 UTC	956	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 61 61 65 30 35 64 64 34 2d 38 63 63 32 2d 34 38 66 64 2d 61 37 63 64 2d 36 64 65 36 33 62 32 38 38 31 33 61 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"aae05dd4-8cc2-48fd-a7cd-6de63b28813a","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:51 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.5	50482	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:51 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 34 2e 30 34 37 37 37 38 35 34 31 39 33 30 34 31 31 7d Data Ascii: {"pid":"f667a3ac68470510","refAction":"index","siteType":"1","cls":4.047778541930411}
2024-01-15 23:16:51 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:51 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3fad6888361bd8bcd9c5b458635f78d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: pv8dxG45rnCjUxHvZKAGNMFRuPup1-lL4_rErBJSRqIw6q7n3HlZSQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.5	50483	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2498 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:51 UTC	2498	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 76 68 6d 69 42 52 51 74 41 41 41 41 3a 65 4a 45 66 57 49 45 75 54 6e 48 65 71 50 64 52 6c 68 72 4c 6f 44 69 74 6b 65 57 61 66 51 49 70 48 75 73 30 30 4f 57 51 46 51 6f 56 59 77 4b 45 66 4a 73 6a 31 52 6a 79 34 37 62 42 6b 65 65 43 78 58 6d 72 31 4f 73 62 39 41 5a 38 74 79 32 67 65 32 53 6c 49 6c 4a 4a 63 55 54 6f 66 4a 37 4f 46 45 4a 59 7a 45 6b 6a 6a 37 35 4d 64 51 69 61 69 2b 39 36 57 46 77 57 75 48 59 71 71 5a 52 78 76 78 38 33 67 61 79 77 77 70 51 73 7a 71 7a 70 6f 35 52 4c 47 49 32 6b 6e 57 67 77 58 54 4e 35 46 36 65 59 30 70 42 4e 6c 77 52 52 71 59 67 4a 73 34 6c 75 4f 6e Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvhmiBRQtAAAA:eJEfWIEuTnHeqPdRlhrLoDitkeWafQIpHus00OWQFQoVYwKEfJsj1Rjy47bBkeeCxXmr1Osb9AZ8ty2ge2SlIlJJcUTofJ7OFEJYzEkjj75MdQiai+96WFwWuHYqqZRxvx83gaywwpQszqzpo5RLGI2knWgwXTN5F6eY0pBNlwRRqYgJs4luOn
2024-01-15 23:16:51 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1124 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:51 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce3-0325bc466fbba23100e0e5fb X-Cache: Miss from cloudfront Via: 1.1 90ad2a23a8617490c9d13e1f260633f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: IO-OWR6i_rFfxPOim1TkE7Z1XC4HRuN-mwdipSu-yG0OX-y8lqh9fg==
2024-01-15 23:16:51 UTC	1124	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 67 6f 53 69 59 6d 38 6a 41 41 41 41 3a 78 68 50 37 2b 41 54 30 4e 47 6d 69 44 79 6f 42 7a 53 45 67 74 61 75 34 76 56 53 65 30 67 4c 43 33 35 63 46 6e 6c 5a 55 63 44 78 6e 75 49 47 7a 59 33 78 78 69 75 72 47 4a 39 6a 4f 35 49 74 39 6e 58 74 71 64 59 79 68 2f 48 2b 63 71 2b 4b 37 74 68 69 66 37 79 50 75 55 6d 72 46 32 6c 5a 6f 49 50 67 58 32 71 36 52 6a 56 6e 37 59 2f 55 50 56 4e 48 63 4a 65 6a 41 50 36 4e 51 76 47 56 65 32 4f 51 73 32 4c 2f 66 67 53 77 72 50 44 71 4e 45 6a 46 49 48 64 6a 2f 4b 6b 5a 41 4e 57 68 71 4c 6e 39 42 59 47 66 34 41 43 47 58 7a 34 6e 6d 7a 74 31 6d 54 55 46 56 48 47 38 38 61 4b 2b Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgoSiYm8jAAAA:xhP7+AT0NGmiDyoBzSEgtau4vVSe0gLC35cFnlZUcDxnuIGzY3xxiurGJ9jO5It9nXtqdYyh/H+cq+K7thif7yPuUmrF2lZoIPgX2q6RjVn7Y/UPVNHcJejAP6NQvGVe2OQs2L/fgSwrPDqNEjFIHdj/KkZANWhqLn9BYGf4ACGXz4nmzt1mTUFVHG88aK+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.5	50484	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	726	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1082 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:51 UTC	1082	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 61 36 33 31 31 65 65 65 2d 35 33 61 32 2d 34 31 34 31 2d 39 31 39 35 2d 61 62 66 61 37 34 32 30 62 63 61 33 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"a6311eee-53a2-4141-9195-abfa7420bca3","ss":"1a065792-be81-49f6-b178-47e74a8775d1","sh":1024,"s
2024-01-15 23:16:51 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.5	50485	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	5625	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvhmiBRQtAAAA:eJEfWIEuTnHeqPdRlhrLoDitkeWafQIpHus00OWQFQoVYwKEfJsj1Rjy47bBkeeCxXmr1Osb9AZ8ty2ge2SlIlJJcUTofJ7OFEJYzEkjj75MdQiai+96WFwWuHYqqZRxvx83gaywwpQszqzpo5RLGI2knWgwXTN5F6eY0pBNlwRRqYgJs4luOnhRI3rH07fkANS3V+umKnIBj6yo2K/KM/lwfyWiKubMWNNynPvAL1rjLXWJFGVKob3jtHGkc2XgcwWnAw6j; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UHzjYnZGn16VCX5L2NGxtiSjr42O6nuy2scgYbEUwaEsOMudjJjOTGQA9z7pibIMlBVPgg4t2G7BVY0S%2BSP4ZHL1F9wngO%2FeIZDcfRjd%2BEhh1vd0x2qXM9gmI3072msR3YMICPT9WhT9vc%2FUc0jV56XDywMcEeJBA%3D; lastSeen=1705360610369
2024-01-15 23:16:51 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:51 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=fe4aa3b1ab75010a&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJLz5YHgYDfp-2B4U5n6VeHAr2rClR_-VA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7fc4d53a17d950b206cd9fccf1108b8a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: -jXM0ETrN0xxjG3tIhu3gedanpHJ9rVGfAyxAWm2X1CzONWcaTfKtA==
2024-01-15 23:16:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.5	50460	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	4693	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=WFvK9uf1Sp-HiPg5Bwat9g&site=bookings2&sid=0059242d4bafbe759210d4ea3ea582cb&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=32&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=102.165.48.42&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065a5bcb805093c99d94ccf114c54497f_1705359600&rmk_var=-1&euuid=2f16f2b4-9344-4d1f-8f1c-d915a14c4311&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2Findex.html&r=&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=1575297318 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvhmiBRQtAAAA:eJEfWIEuTnHeqPdRlhrLoDitkeWafQIpHus00OWQFQoVYwKEfJsj1Rjy47bBkeeCxXmr1Osb9AZ8ty2ge2SlIlJJcUTofJ7OFEJYzEkjj75MdQiai+96WFwWuHYqqZRxvx83gaywwpQszqzpo5RLGI2knWgwXTN5F6eY0pBNlwRRqYgJs4luOnhRI3rH07fkANS3V+umKnIBj6yo2K/KM/lwfyWiKubMWNNynPvAL1rjLXWJFGVKob3jtHGkc2XgcwWnAw6j; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UHzjYnZGn16VCX5L2NGxtiSjr42O6nuy2scgYbEUwaEsOMudjJjOTGQA9z7pibIMlBVPgg4t2G7BVY0S%2BSP4ZHL1F9wngO%2FeIZDcfRjd%2BEhh1vd0x2qXM9gmI3072msR3YMICPT9WhT9vc%2FUc0jV56XDywMcEeJBA%3D
2024-01-15 23:16:51 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:51 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8517a3b133f60326&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjvcmFkNVyo4rAgErPrvsDFr0wCf8WUhQ6g x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: KW7Hloe_xXbQUP8udkPiNnjUxweLkd0DOonOwk3bVhFF_3fR-74qFA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.5	50486	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	3984	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 692 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VMqmqEE1OmCHHnUXJaRUDgbesI5l%2FuE5CahsgzBYbuFOtTjKWjKmQPuo9wmhL8%2BJ7ZGLKQITO5CTboKAdJfSjXlJGlE%2F7oHPIYG4wedh1RdL40dQUQiM8k6%2Blo6aXJJ0cBaMSpKzyVLbVTmIGMz6BDg%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgoSiYm8jAAAA:xhP7+AT0NGmiDyoBzSEgtau4vVSe0gLC35cFnlZUcDxnuIGzY3xxiurGJ9jO5It9nXtqdYyh/H+cq+K7thif7yPuUmrF2lZoIPgX2q6RjVn7Y/UPVNHcJejAP6NQvGVe2OQs2L/fgSwrPDqNEjFIHdj/KkZANWhqLn9BYGf4ACGXz4nmzt1mTUFVHG88aK+hQRIYLYz+HKfGKkFDkgjTH3zUGSVudrqq/g/osN/el4Lo1SxXNXkjGHqSCBozXgESSQfO0dbZ
2024-01-15 23:16:51 UTC	692	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 56 69 65 77 65 64 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 74 72 61 63 6b 69 6e 67 5f 69 6e 66 6f 22 3a 7b 22 6e 64 69 73 70 6c 61 79 5f 61 64 5f 69 64 22 3a 22 37 65 37 65 32 62 65 64 2d 38 36 30 64 2d 34 61 62 37 2d 61 66 65 63 2d 31 33 34 64 31 33 62 61 38 39 39 39 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 76 69 65 77 5f 69 64 22 3a 22 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 Data Ascii: {"operationName":"trackAdViewed","variables":{"input":{"tracking_info":{"ndisplay_ad_id":"7e7e2bed-860d-4ab7-afec-134d13ba8999","rendered_ad_pageview_id":"f667a3ac68470510","rendered_ad_pagename":"INDEX","rendered_ad_position":"INDEX_PRIMARY","vertical":"
2024-01-15 23:16:52 UTC	1087	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:52 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:52 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=225ca3b2ffc100d4&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGb__K9y7zyZ6msdOlRqX_6fIGfTf08kCNg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 3SwYnuXTdnl9H8w9NNED6_d1Cgm-bXsicmoqjRih4cv0wTmYmrpYBg==
2024-01-15 23:16:52 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 56 69 65 77 65 64 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 Data Ascii: {"data":{"trackAdViewed":{"directivesByName":{},"extensionDefinitions":[],"childrenWithTypeReferences":{"empty":false,"childrenAsList":[],"children":{"appliedDirectives":[],"directives":[]}},"name":"JSON","allDirectivesByName":{},"appliedDirectives":[],"c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.5	50487	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	3984	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 353 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYwMCwiZXhwIjoxNzA1NDQ3MDAwfQ.sXGmUKqWD8VV8OyiNGrFxJKofLo25NL0gjlhhhDuBDx1XY73XLRBpGisOA2MoRASSDyJHUjJMO2qfWYqR9HLiQ x-booking-et-serialized-state: EbdgRkL6w6t16I5mBqbLGnkYiuakYC38PUPzN10tyxRJ-MdowFYVV1qT1LG6LPJEQ x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: f667a3ac68470510 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VMqmqEE1OmCHHnUXJaRUDgbesI5l%2FuE5CahsgzBYbuFOtTjKWjKmQPuo9wmhL8%2BJ7ZGLKQITO5CTboKAdJfSjXlJGlE%2F7oHPIYG4wedh1RdL40dQUQiM8k6%2Blo6aXJJ0cBaMSpKzyVLbVTmIGMz6BDg%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgoSiYm8jAAAA:xhP7+AT0NGmiDyoBzSEgtau4vVSe0gLC35cFnlZUcDxnuIGzY3xxiurGJ9jO5It9nXtqdYyh/H+cq+K7thif7yPuUmrF2lZoIPgX2q6RjVn7Y/UPVNHcJejAP6NQvGVe2OQs2L/fgSwrPDqNEjFIHdj/KkZANWhqLn9BYGf4ACGXz4nmzt1mTUFVHG88aK+hQRIYLYz+HKfGKkFDkgjTH3zUGSVudrqq/g/osN/el4Lo1SxXNXkjGHqSCBozXgESSQfO0dbZ
2024-01-15 23:16:51 UTC	353	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 76 69 65 77 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 36 35 37 35 30 39 33 34 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_viewed","campaign_id":"3265750934","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"m
2024-01-15 23:16:52 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:52 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMATyRavh3uL%2BXLMdsGZPZ2eCGVVMyvidHZ0g8hEQm3pDu0HxATmT7uBe7YO%2Fmg7sGtZbOHrSiTuw4fdUYz1qmIt0KzSZPTcBGTsMySH3rp8eJrfg%2FPkT%2FMhxVZz8VdmVFVatruaChQKq7U%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:16:52 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e4bfa3b2439802e1&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfrfXpydJjhkO4k5QaZefvaQDkC__racRw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: vkKmencpLvM1vUnYhu1yagSHHXx1hvXnmWLCUHswlDFFwa_Jq3PlRQ==
2024-01-15 23:16:52 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b Data Ascii: {"data":{"trackAdStatus":{"description":"A JSON scalar","name":"JSON","directives":[],"childrenWithTypeReferences":{"empty":false,"childrenAsList":[],"children":{"directives":[],"appliedDirectives":[]}},"directivesByName":{},"allAppliedDirectivesByName":{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.5	50489	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:51 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2562 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:51 UTC	2562	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 67 6f 53 69 59 6d 38 6a 41 41 41 41 3a 78 68 50 37 2b 41 54 30 4e 47 6d 69 44 79 6f 42 7a 53 45 67 74 61 75 34 76 56 53 65 30 67 4c 43 33 35 63 46 6e 6c 5a 55 63 44 78 6e 75 49 47 7a 59 33 78 78 69 75 72 47 4a 39 6a 4f 35 49 74 39 6e 58 74 71 64 59 79 68 2f 48 2b 63 71 2b 4b 37 74 68 69 66 37 79 50 75 55 6d 72 46 32 6c 5a 6f 49 50 67 58 32 71 36 52 6a 56 6e 37 59 2f 55 50 56 4e 48 63 4a 65 6a 41 50 36 4e 51 76 47 56 65 32 4f 51 73 32 4c 2f 66 67 53 77 72 50 44 71 4e 45 6a 46 49 48 64 6a 2f 4b 6b 5a 41 4e 57 68 71 4c 6e 39 42 59 47 66 34 41 43 47 58 7a 34 6e 6d 7a 74 31 6d 54 55 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgoSiYm8jAAAA:xhP7+AT0NGmiDyoBzSEgtau4vVSe0gLC35cFnlZUcDxnuIGzY3xxiurGJ9jO5It9nXtqdYyh/H+cq+K7thif7yPuUmrF2lZoIPgX2q6RjVn7Y/UPVNHcJejAP6NQvGVe2OQs2L/fgSwrPDqNEjFIHdj/KkZANWhqLn9BYGf4ACGXz4nmzt1mTU
2024-01-15 23:16:52 UTC	586	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1212 Connection: close Date: Mon, 15 Jan 2024 23:16:52 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce3-46df183d2ce552455560958e X-Cache: Miss from cloudfront Via: 1.1 90ad2a23a8617490c9d13e1f260633f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: zFZ3m9QYHhWKrDtvfJlHwJ-wE-8wG4SCKEKgrhy-oNI9Ce4FvfnWkw==
2024-01-15 23:16:52 UTC	1212	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 76 53 4b 6a 4a 48 67 50 41 41 41 41 3a 50 65 58 54 79 72 33 74 70 4b 34 52 43 72 7a 72 50 5a 53 72 51 43 52 43 6c 67 69 49 4e 75 67 54 32 72 57 77 30 70 54 69 78 79 38 49 33 49 54 41 71 30 45 54 36 31 75 39 69 64 78 78 4b 47 49 52 42 42 65 72 6c 74 41 45 50 41 31 6f 4b 32 48 66 6f 47 66 33 2b 50 62 42 5a 70 74 6c 53 4e 42 32 45 72 70 55 61 55 38 4d 53 55 6e 57 77 79 59 42 41 37 31 78 4f 64 58 36 5a 6c 6e 53 6a 52 61 32 77 65 2f 5a 77 78 76 2f 33 57 5a 52 70 67 67 66 39 6b 71 70 32 6e 70 6a 45 62 4a 7a 4d 31 77 5a 42 42 6e 6a 51 74 4c 43 51 34 48 49 35 4e 4c 51 6e 57 49 63 58 6c 4c 44 74 30 55 44 38 61 61 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvSKjJHgPAAAA:PeXTyr3tpK4RCrzrPZSrQCRClgiINugT2rWw0pTixy8I3ITAq0ET61u9idxxKGIRBBerltAEPA1oK2HfoGf3+PbBZptlSNB2ErpUaU8MSUnWwyYBA71xOdX6ZlnSjRa2we/Zwxv/3WZRpggf9kqp2npjEbJzM1wZBBnjQtLCQ4HI5NLQnWIcXlLDt0UD8aa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.5	50490	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:52 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 899 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:52 UTC	899	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 66 65 37 30 61 32 39 62 2d 62 31 63 37 2d 34 64 38 31 2d 38 62 31 65 2d 37 63 39 64 62 39 35 35 30 37 39 38 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"fe70a29b-b1c7-4d81-8b1e-7c9db9550798","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:16:52 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:52 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.5	50491	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:52 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 893 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:52 UTC	893	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 38 65 37 64 36 36 64 62 2d 34 38 35 34 2d 34 62 63 33 2d 38 30 39 61 2d 65 63 34 63 64 63 64 35 37 38 38 34 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"8e7d66db-4854-4bc3-809a-ec4cdcd57884","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:16:52 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:52 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.5	50492	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:52 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2651 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:52 UTC	2651	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 76 53 4b 6a 4a 48 67 50 41 41 41 41 3a 50 65 58 54 79 72 33 74 70 4b 34 52 43 72 7a 72 50 5a 53 72 51 43 52 43 6c 67 69 49 4e 75 67 54 32 72 57 77 30 70 54 69 78 79 38 49 33 49 54 41 71 30 45 54 36 31 75 39 69 64 78 78 4b 47 49 52 42 42 65 72 6c 74 41 45 50 41 31 6f 4b 32 48 66 6f 47 66 33 2b 50 62 42 5a 70 74 6c 53 4e 42 32 45 72 70 55 61 55 38 4d 53 55 6e 57 77 79 59 42 41 37 31 78 4f 64 58 36 5a 6c 6e 53 6a 52 61 32 77 65 2f 5a 77 78 76 2f 33 57 5a 52 70 67 67 66 39 6b 71 70 32 6e 70 6a 45 62 4a 7a 4d 31 77 5a 42 42 6e 6a 51 74 4c 43 51 34 48 49 35 4e 4c 51 6e 57 49 63 58 6c Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvSKjJHgPAAAA:PeXTyr3tpK4RCrzrPZSrQCRClgiINugT2rWw0pTixy8I3ITAq0ET61u9idxxKGIRBBerltAEPA1oK2HfoGf3+PbBZptlSNB2ErpUaU8MSUnWwyYBA71xOdX6ZlnSjRa2we/Zwxv/3WZRpggf9kqp2npjEbJzM1wZBBnjQtLCQ4HI5NLQnWIcXl
2024-01-15 23:16:52 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1300 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:52 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce4-538413393d208c9164b3c2be X-Cache: Miss from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: YVLqgYRSd4ADuRg2F5dhF7UhX1PoZtk3KLhL5SG20h3d_fQw-h_3RA==
2024-01-15 23:16:52 UTC	1300	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 5a 35 75 6a 48 61 51 57 41 41 41 41 3a 4e 47 47 43 76 4b 59 78 73 43 79 37 32 58 52 6f 55 30 2b 34 41 39 4c 6c 55 70 75 77 77 66 5a 42 38 38 48 4e 66 32 65 4e 6d 4c 72 59 59 57 2f 65 58 6c 41 4b 49 37 4b 33 6b 70 55 56 39 50 6d 39 53 66 37 74 76 30 70 50 63 42 54 4d 74 64 45 33 79 38 31 4a 71 52 4e 56 54 52 44 32 53 7a 68 73 2b 58 4e 70 43 32 73 38 74 30 4f 4a 53 6b 36 35 76 49 78 70 45 4b 65 59 48 37 65 62 32 65 68 4a 6c 37 65 75 67 48 72 45 37 4f 73 31 36 58 75 71 74 47 46 4d 6a 54 6e 6b 49 4e 54 78 64 4b 48 36 30 4c 73 70 61 4b 49 35 39 31 78 76 64 52 6c 4b 59 71 45 41 43 56 46 37 74 31 6e 71 41 77 35 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAZ5ujHaQWAAAA:NGGCvKYxsCy72XRoU0+4A9LlUpuwwfZB88HNf2eNmLrYYW/eXlAKI7K3kpUV9Pm9Sf7tv0pPcBTMtdE3y81JqRNVTRD2Szhs+XNpC2s8t0OJSk65vIxpEKeYH7eb2ehJl7eugHrE7Os16XuqtGFMjTnkINTxdKH60LspaKI591xvdRlKYqEACVF7t1nqAw5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.5	50493	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:52 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:52 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 66 36 36 37 61 33 61 63 36 38 34 37 30 35 31 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 38 2e 34 33 30 30 38 34 32 33 36 30 38 36 34 37 34 7d Data Ascii: {"pid":"f667a3ac68470510","refAction":"index","siteType":"1","cls":8.430084236086474}
2024-01-15 23:16:53 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:52 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6946167499a4b8f515865d62f0b0b284.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: TVJKqEF-Qzvocl7Smwpa6Vt7aV-6ToGPjjBX2h5v9vhkwC_bR6V8aw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.5	50494	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:52 UTC	5617	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|8\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3 X-Booking-CSRF: GPWlZQAAAAA=8AJpFCC3icrEaEWxJe0UcEXareS4Vjn8T1gvFzsTBzkwVoX4U2COSzX0mhqQwZygzbNP1wkz35I4elBJn-7YgeS2oHfDZesNjnOJub5ifVBZrAKkn9LRj6bBOsN7zrZ8oZaso_tHPb_Qe9uSTNlBZT4ZSglYmx4AEOn6jieIXMGYdovI2QmSnzwLuAjmnzFezVTizjka7YeRthUb sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: f667a3ac68470510 X-Booking-Info: 1856820,1865390,1890130,1898410,1898450,1901030,1901160,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|2,1885360\|1,cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvSKjJHgPAAAA:PeXTyr3tpK4RCrzrPZSrQCRClgiINugT2rWw0pTixy8I3ITAq0ET61u9idxxKGIRBBerltAEPA1oK2HfoGf3+PbBZptlSNB2ErpUaU8MSUnWwyYBA71xOdX6ZlnSjRa2we/Zwxv/3WZRpggf9kqp2npjEbJzM1wZBBnjQtLCQ4HI5NLQnWIcXlLDt0UD8aa+EEvm1jRQND5onrrCOshU1S5d+5CCOMZkDwxihqog7Cd9IOplY4GxTV+wpXP41Xo+yDvHrcoi; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D
2024-01-15 23:16:53 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:53 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1438a3b2405600e4&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKpxUZhH_pKYUcOhzVmt8b1hEBEXa-oBXg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4346add631a498bf6cdbf88cbc5ff12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: hkOAzhvPR5a_lyInuhVWtW5CVsNVHp_0c0DCEgMCBsYLQYKzQM6MzQ==
2024-01-15 23:16:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.5	50496	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:53 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2759 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:53 UTC	2759	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 5a 35 75 6a 48 61 51 57 41 41 41 41 3a 4e 47 47 43 76 4b 59 78 73 43 79 37 32 58 52 6f 55 30 2b 34 41 39 4c 6c 55 70 75 77 77 66 5a 42 38 38 48 4e 66 32 65 4e 6d 4c 72 59 59 57 2f 65 58 6c 41 4b 49 37 4b 33 6b 70 55 56 39 50 6d 39 53 66 37 74 76 30 70 50 63 42 54 4d 74 64 45 33 79 38 31 4a 71 52 4e 56 54 52 44 32 53 7a 68 73 2b 58 4e 70 43 32 73 38 74 30 4f 4a 53 6b 36 35 76 49 78 70 45 4b 65 59 48 37 65 62 32 65 68 4a 6c 37 65 75 67 48 72 45 37 4f 73 31 36 58 75 71 74 47 46 4d 6a 54 6e 6b 49 4e 54 78 64 4b 48 36 30 4c 73 70 61 4b 49 35 39 31 78 76 64 52 6c 4b 59 71 45 41 43 56 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAZ5ujHaQWAAAA:NGGCvKYxsCy72XRoU0+4A9LlUpuwwfZB88HNf2eNmLrYYW/eXlAKI7K3kpUV9Pm9Sf7tv0pPcBTMtdE3y81JqRNVTRD2Szhs+XNpC2s8t0OJSk65vIxpEKeYH7eb2ehJl7eugHrE7Os16XuqtGFMjTnkINTxdKH60LspaKI591xvdRlKYqEACV
2024-01-15 23:16:54 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1389 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:54 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce6-69a236ff2ab7070f474dd093 X-Cache: Miss from cloudfront Via: 1.1 4a21175361a1e842a337986b5f7399aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: jWR2-8dQq5WJhckPkh4-KarMMOzJTNxrGoG05llXYgIpQxHpkrWHDA==
2024-01-15 23:16:54 UTC	1389	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 75 39 61 69 4a 74 6f 6d 41 41 41 41 3a 31 66 79 61 47 47 76 2b 35 48 64 43 54 74 30 33 67 64 74 33 76 59 4d 43 2b 51 4b 77 62 44 7a 74 62 2f 5a 51 4e 38 34 65 64 4b 38 68 61 64 7a 71 45 64 49 32 68 41 42 7a 33 38 4a 6d 65 51 55 47 2f 5a 4a 6e 5a 55 38 78 39 59 33 67 73 72 58 41 6f 6f 6c 67 49 5a 66 7a 38 4e 77 2f 54 46 64 6c 2b 65 6a 4b 4f 68 63 54 58 55 75 4e 35 2f 55 58 48 54 79 4b 4a 2b 4f 73 49 35 61 79 2f 65 69 58 78 69 51 76 39 57 44 69 45 2f 71 7a 70 64 45 32 2b 4a 2b 67 66 59 50 37 77 77 44 47 61 43 6a 30 34 6c 62 58 42 2f 2b 4d 6b 55 36 71 2b 34 4e 79 74 50 67 7a 59 72 65 77 54 6a 67 59 31 72 37 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAu9aiJtomAAAA:1fyaGGv+5HdCTt03gdt3vYMC+QKwbDztb/ZQN84edK8hadzqEdI2hABz38JmeQUG/ZJnZU8x9Y3gsrXAoolgIZfz8Nw/TFdl+ejKOhcTXUuN5/UXHTyKJ+OsI5ay/eiXxiQv9WDiE/qzpdE2+J+gfYP7wwDGaCj04lbXB/+MkU6q+4NytPgzYrewTjgY1r7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.5	50495	172.253.63.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:53 UTC	1992	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je41a0v888381215z879615461&_p=1705360606642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2Findex.html&sid=1705360585&sct=1&seg=1&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&epn.cd_logged_in=0&ep.cd_tsmp=1705360607182&ep.cd_user_location=us&ep.cd_site_section=Stays&_et=10&up.up_ga_client_id=810723182.1705360577&upn.up_is_subscribed_to_newsletter=0&tfd=13658 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:54 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Mon, 15 Jan 2024 23:16:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.5	50497	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:56 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2832 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:56 UTC	2832	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 75 39 61 69 4a 74 6f 6d 41 41 41 41 3a 31 66 79 61 47 47 76 2b 35 48 64 43 54 74 30 33 67 64 74 33 76 59 4d 43 2b 51 4b 77 62 44 7a 74 62 2f 5a 51 4e 38 34 65 64 4b 38 68 61 64 7a 71 45 64 49 32 68 41 42 7a 33 38 4a 6d 65 51 55 47 2f 5a 4a 6e 5a 55 38 78 39 59 33 67 73 72 58 41 6f 6f 6c 67 49 5a 66 7a 38 4e 77 2f 54 46 64 6c 2b 65 6a 4b 4f 68 63 54 58 55 75 4e 35 2f 55 58 48 54 79 4b 4a 2b 4f 73 49 35 61 79 2f 65 69 58 78 69 51 76 39 57 44 69 45 2f 71 7a 70 64 45 32 2b 4a 2b 67 66 59 50 37 77 77 44 47 61 43 6a 30 34 6c 62 58 42 2f 2b 4d 6b 55 36 71 2b 34 4e 79 74 50 67 7a 59 72 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAu9aiJtomAAAA:1fyaGGv+5HdCTt03gdt3vYMC+QKwbDztb/ZQN84edK8hadzqEdI2hABz38JmeQUG/ZJnZU8x9Y3gsrXAoolgIZfz8Nw/TFdl+ejKOhcTXUuN5/UXHTyKJ+OsI5ay/eiXxiQv9WDiE/qzpdE2+J+gfYP7wwDGaCj04lbXB/+MkU6q+4NytPgzYr
2024-01-15 23:16:56 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1477 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:56 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bce8-31f33e303d643c3203687428 X-Cache: Miss from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WhOXkdVMMxu9v8u9z-KcV4c8DE1gzvwluPFrau1YR8G9faaEcV9MJg==
2024-01-15 23:16:56 UTC	1477	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 36 75 68 2b 6f 42 4f 41 41 41 41 3a 4b 31 63 44 38 71 33 6e 66 71 48 55 30 72 6f 38 67 75 77 67 53 68 63 4f 6f 62 6d 36 34 54 4b 79 59 31 37 53 39 39 65 38 30 43 6b 37 4a 73 38 52 56 51 79 30 48 5a 49 46 67 77 66 41 46 79 69 71 6a 37 4a 30 7a 47 55 57 45 6c 54 78 72 4a 38 50 32 42 2b 71 36 4e 7a 70 6f 65 4b 38 51 73 72 6c 53 79 75 57 61 6f 52 4d 46 75 6d 7a 42 72 39 36 78 52 59 59 44 46 69 70 64 38 50 5a 70 76 76 70 70 78 66 35 68 37 2f 79 64 41 58 47 30 59 54 79 63 4c 43 32 4b 56 4a 33 74 30 6a 61 52 57 43 70 70 76 49 76 6b 35 37 4c 6d 67 64 37 78 75 43 66 68 2f 52 52 30 55 57 36 7a 4d 61 77 57 30 2f Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oBOAAAA:K1cD8q3nfqHU0ro8guwgShcOobm64TKyY17S99e80Ck7Js8RVQy0HZIFgwfAFyiqj7J0zGUWElTxrJ8P2B+q6NzpoeK8QsrlSyuWaoRMFumzBr96xRYYDFipd8PZpvvppxf5h7/ydAXG0YTycLC2KVJ3t0jaRWCppvIvk57Lmgd7xuCfh/RR0UW6zMawW0/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.5	50499	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:57 UTC	2774	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oBOAAAA:K1cD8q3nfqHU0ro8guwgShcOobm64TKyY17S99e80Ck7Js8RVQy0HZIFgwfAFyiqj7J0zGUWElTxrJ8P2B+q6NzpoeK8QsrlSyuWaoRMFumzBr96xRYYDFipd8PZpvvppxf5h7/ydAXG0YTycLC2KVJ3t0jaRWCppvIvk57Lmgd7xuCfh/RR0UW6zMawW0/DYVvOCS/eeNA3sFuiRf+Q52AiNAbzApWFRNL6ehbE9Eih4SnldTdcXMQqWjrSeBGHFBch+zfG
2024-01-15 23:16:57 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:57 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=98a7a3b46bf9050e&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvTmzUtMzAXxzc8r_jf0yeibVntQW6Cd68 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: _td-xlIMck_QYwsrgolMBmn75bATBc22e5Ldm3ObQnslxXHnLhIc9w==
2024-01-15 23:16:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.5	50501	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:57 UTC	3274	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=cCHObIKELcMWSRSPFeSICZYUNZdeLEccCcCcCC\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oBOAAAA:K1cD8q3nfqHU0ro8guwgShcOobm64TKyY17S99e80Ck7Js8RVQy0HZIFgwfAFyiqj7J0zGUWElTxrJ8P2B+q6NzpoeK8QsrlSyuWaoRMFumzBr96xRYYDFipd8PZpvvppxf5h7/ydAXG0YTycLC2KVJ3t0jaRWCppvIvk57Lmgd7xuCfh/RR0UW6zMawW0/DYVvOCS/eeNA3sFuiRf+Q52AiNAbzApWFRNL6ehbE9Eih4SnldTdcXMQqWjrSeBGHFBch+zfG
2024-01-15 23:16:57 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:57 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=831da3b49c5e0190&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIJu05guDXxGfZegtP0NneMhrImzOVeEkI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: y9tAJFyRjMI7MmqrcrQi99O7RAphDhHRRCrLMnLF2cz1so9lDWVj8w==
2024-01-15 23:16:57 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.5	50502	108.138.85.68	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:57 UTC	2127	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=YTIVNEQE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360610369; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D
2024-01-15 23:16:57 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:57 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 22ab92a35add26b3d8027870bbb6c672.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: FPfPxP2DYsEucetzx0KgbEzBLEE1cvG-wr_V0VvjocjJpbtgb5YRDA==
2024-01-15 23:16:57 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-01-15 23:16:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.5	50498	142.251.163.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:57 UTC	1231	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 9580 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=u-xcq3POCWFlCr3x8_IPxgPu&size=invisible&cb=rdccp2rifbni Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:57 UTC	9580	OUT	Data Raw: 0a 18 75 2d 78 63 71 33 50 4f 43 57 46 6c 43 72 33 78 38 5f 49 50 78 67 50 75 12 8e 0f 30 33 41 46 63 57 65 41 34 51 54 49 52 72 44 76 76 6b 50 50 41 36 5f 68 76 79 35 63 64 5f 68 79 54 30 2d 62 57 50 47 55 69 6b 42 55 68 71 4b 68 56 45 4e 56 49 33 79 70 69 44 72 51 4c 46 41 58 62 41 6c 7a 66 49 4c 34 70 79 56 47 73 33 63 6b 53 4d 38 64 68 33 5f 64 6d 65 50 79 63 43 71 50 67 47 53 68 6d 34 56 34 2d 45 57 6f 6a 65 2d 69 73 55 32 41 63 33 53 79 44 72 71 70 4a 33 4e 66 78 76 67 49 56 71 76 4b 46 64 72 4c 79 6d 4e 32 79 6a 5a 50 62 72 6f 69 5f 42 36 70 57 68 5a 6a 32 57 61 67 67 62 55 51 51 4d 52 58 31 49 76 33 4a 48 30 33 4f 67 75 4d 38 44 4d 32 68 6f 69 4e 49 72 41 39 4b 4d 30 55 79 34 45 32 4e 57 34 79 6b 6d 50 44 33 45 61 39 62 64 69 68 4d 6f 49 7a 73 36 Data Ascii: u-xcq3POCWFlCr3x8_IPxgPu03AFcWeA4QTIRrDvvkPPA6_hvy5cd_hyT0-bWPGUikBUhqKhVENVI3ypiDrQLFAXbAlzfIL4pyVGs3ckSM8dh3_dmePycCqPgGShm4V4-EWoje-isU2Ac3SyDrqpJ3NfxvgIVqvKFdrLymN2yjZPbroi_B6pWhZj2WaggbUQQMRX1Iv3JH03OguM8DM2hoiNIrA9KM0Uy4E2NW4ykmPD3Ea9bdihMoIzs6
2024-01-15 23:16:57 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 15 Jan 2024 23:16:57 GMT Expires: Mon, 15 Jan 2024 23:16:57 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09APYnBZXVbwUfTkE1FvhfctoQkb_AB75ZHXpX52WiXk73rmTOX3G2-me0DdR-qAWYXsnn4sQFahK3c4tOImaZKqE;Path=/recaptcha;Expires=Sat, 13-Jul-2024 23:16:57 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:57 UTC	556	IN	Data Raw: 61 38 62 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 43 49 69 77 72 63 6b 48 74 39 6b 4a 2d 74 75 53 36 61 4a 6f 42 51 68 59 6b 4f 58 48 38 4b 6b 35 6d 47 6a 6d 56 69 74 6c 68 4a 33 4d 30 77 39 47 7a 71 45 6d 74 4f 36 47 77 47 51 6d 76 79 64 72 54 33 59 4e 6e 36 68 49 47 39 79 62 69 39 73 45 35 4e 4f 31 32 36 75 4a 4b 73 34 41 4b 49 35 30 63 71 57 56 43 4e 70 61 36 67 32 4d 4d 37 6b 5a 38 54 43 4b 6d 46 68 4b 38 6d 61 59 7a 68 34 65 52 4d 38 67 52 48 70 4a 38 43 5a 61 56 44 45 67 50 41 54 67 45 77 4d 36 4e 56 49 56 37 39 58 76 30 50 59 6b 5a 2d 6e 43 76 6c 34 50 6f 5a 43 54 50 52 30 70 79 50 5a 4b 43 64 44 4e 4d 33 61 6f 4f 37 33 53 75 36 49 30 68 4d 6f 42 71 47 42 38 53 53 6f 6e 4a 49 63 34 33 55 50 51 43 33 61 56 38 42 Data Ascii: a8b)]}'["rresp","03AFcWeA5CIiwrckHt9kJ-tuS6aJoBQhYkOXH8Kk5mGjmVitlhJ3M0w9GzqEmtO6GwGQmvydrT3YNn6hIG9ybi9sE5NO126uJKs4AKI50cqWVCNpa6g2MM7kZ8TCKmFhK8maYzh4eRM8gRHpJ8CZaVDEgPATgEwM6NVIV79Xv0PYkZ-nCvl4PoZCTPR0pyPZKCdDNM3aoO73Su6I0hMoBqGB8SSonJIc43UPQC3aV8B
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 34 34 46 72 48 30 71 77 5a 33 6d 4b 61 42 59 48 46 6d 79 79 47 38 32 4b 30 57 52 30 6f 51 41 56 45 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 38 77 51 33 46 74 64 7a 59 30 64 6c 5a 45 5a 46 68 71 52 31 70 46 62 31 4e 4f 4d 6b 35 71 52 6d 4d 32 63 79 31 42 51 55 52 6c 59 55 6f 78 5a 6a 4e 35 62 31 68 56 62 44 4a 42 4c 6d 70 7a 22 2c 22 22 2c 22 59 31 6c 43 63 57 6c 4d 61 6c 68 50 61 54 68 42 63 7a 45 7a 4b 30 74 6e 57 45 4e 50 55 48 42 6a 53 54 42 52 54 44 6c 35 62 6d 74 59 59 30 70 78 5a 47 46 4a 4e 56 52 79 52 7a 52 76 52 6b 31 33 64 31 4a 4a 5a 55 5a 78 54 58 64 54 65 6e 46 61 53 57 70 50 4d 56 4a Data Ascii: 44FrH0qwZ3mKaBYHFmyyG82K0WR0oQAVE",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy8wQ3FtdzY0dlZEZFhqR1pFb1NOMk5qRmM2cy1BQURlYUoxZjN5b1hVbDJBLmpz","","Y1lCcWlMalhPaThBczEzK0tnWENPUHBjSTBRTDl5bmtYY0pxZGFJNVRyRzRvRk13d1JJZUZxTXdTenFaSWpPMVJ
2024-01-15 23:16:57 UTC	898	IN	Data Raw: 4d 58 46 78 4e 6d 35 51 52 6d 64 4c 51 53 39 51 55 6c 4e 76 5a 32 78 48 56 32 39 4d 57 47 39 6f 53 54 59 77 57 56 6f 7a 51 55 78 79 56 6d 5a 59 4d 54 46 55 54 6a 5a 4f 4d 6c 52 79 57 55 5a 75 4e 44 6c 7a 63 46 52 45 62 56 42 46 63 45 4a 6e 55 6e 41 77 62 32 73 72 4e 57 64 58 4e 7a 42 4b 55 54 6c 69 55 32 35 43 63 54 5a 4e 4f 55 70 6f 51 55 6b 72 4f 47 5a 57 54 58 52 6b 54 30 35 49 57 6d 64 53 4d 46 5a 45 4e 45 56 46 4e 57 6c 70 54 30 56 75 56 30 74 78 53 6d 70 69 62 33 49 34 55 31 52 34 53 45 46 4d 5a 47 77 31 52 30 63 76 51 57 70 50 4d 6b 38 31 56 6d 70 47 54 47 5a 77 63 6a 68 50 59 6e 42 6f 51 56 42 44 59 54 4a 52 5a 54 52 46 64 57 78 43 63 47 4e 4d 4d 6c 6c 51 62 54 51 76 4d 31 70 79 5a 32 31 53 64 30 56 30 57 47 74 5a 63 46 5a 46 54 31 70 35 4e 48 4d Data Ascii: MXFxNm5QRmdLQS9QUlNvZ2xHV29MWG9oSTYwWVozQUxyVmZYMTFUTjZOMlRyWUZuNDlzcFREbVBFcEJnUnAwb2srNWdXNzBKUTliU25CcTZNOUpoQUkrOGZWTXRkT05IWmdSMFZENEVFNWlpT0VuV0txSmpib3I4U1R4SEFMZGw1R0cvQWpPMk81VmpGTGZwcjhPYnBoQVBDYTJRZTRFdWxCcGNMMllQbTQvM1pyZ21Sd0V0WGtZcFZFT1p5NHM
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 31 36 36 36 0d 0a 4e 45 56 4a 64 33 6f 7a 4f 54 59 32 65 6b 6c 54 59 32 45 32 63 44 68 71 61 6a 4e 6a 63 31 64 36 63 6a 68 78 63 7a 56 56 54 79 39 4a 5a 6d 39 76 51 57 5a 4b 53 6c 49 7a 4e 45 64 34 4d 7a 6c 4e 62 30 74 79 4e 33 42 68 63 7a 67 76 53 44 46 77 57 6c 56 61 4e 45 74 32 55 31 5a 50 57 6e 41 33 55 58 56 45 55 58 64 56 4e 58 46 69 4c 7a 6b 77 64 6c 59 78 63 31 67 77 55 46 64 56 62 56 56 69 57 6b 31 32 4d 47 56 78 65 56 46 6f 55 7a 64 4a 53 45 5a 4e 62 45 4d 30 5a 6b 78 45 59 57 56 6b 51 6b 4a 56 57 44 5a 42 4e 6c 59 77 4e 55 4d 31 52 32 5a 48 61 45 4e 44 4e 30 5a 48 62 46 68 53 5a 47 4e 68 54 6c 59 79 54 58 4a 6b 55 33 70 52 57 56 52 6a 57 54 42 71 62 7a 46 71 54 6a 6c 44 61 57 52 4c 5a 32 64 72 4d 57 56 53 5a 46 6c 48 51 57 73 79 65 6b 4e 4b 4b Data Ascii: 1666NEVJd3ozOTY2eklTY2E2cDhqajNjc1d6cjhxczVVTy9JZm9vQWZKSlIzNEd4MzlNb0tyN3BhczgvSDFwWlVaNEt2U1ZPWnA3UXVEUXdVNXFiLzkwdlYxc1gwUFdVbVViWk12MGVxeVFoUzdJSEZNbEM0ZkxEYWVkQkJVWDZBNlYwNUM1R2ZHaENDN0ZHbFhSZGNhTlYyTXJkU3pRWVRjWTBqbzFqTjlDaWRLZ2drMWVSZFlHQWsyekNKK
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 52 5a 57 55 5a 32 56 45 5a 6d 62 32 51 31 61 6e 4a 59 64 45 64 57 62 6d 34 33 55 7a 67 30 56 6b 56 76 57 58 5a 73 53 32 4d 31 4e 47 5a 30 64 56 4a 75 51 55 74 57 4e 6b 46 73 62 6d 31 61 63 32 4a 49 61 33 51 76 52 6c 67 31 59 6d 39 58 52 54 4e 44 62 6a 59 76 56 55 4a 44 63 32 6c 47 52 55 45 34 64 44 42 75 56 33 4a 54 63 45 5a 69 62 54 4e 72 52 6d 68 45 4f 54 68 77 4b 7a 5a 69 4e 33 5a 33 61 33 68 68 62 31 4e 59 61 46 4e 79 4e 6d 52 74 55 32 56 52 52 56 46 68 64 46 42 73 4e 30 4a 61 62 6b 78 4a 5a 32 5a 53 4d 54 64 33 53 47 78 61 4d 30 70 6e 54 33 5a 46 4b 33 52 33 63 47 4d 34 51 58 6f 79 65 45 4e 77 5a 6e 52 56 62 44 68 76 63 46 5a 70 53 31 64 61 55 33 4d 77 61 6a 4e 56 62 6b 59 31 62 30 35 59 64 6c 4a 70 53 6b 74 34 61 6d 70 4b 4e 47 59 35 65 6b 6c 68 4d Data Ascii: RZWUZ2VEZmb2Q1anJYdEdWbm43Uzg0VkVvWXZsS2M1NGZ0dVJuQUtWNkFsbm1ac2JIa3QvRlg1Ym9XRTNDbjYvVUJDc2lGRUE4dDBuV3JTcEZibTNrRmhEOThwKzZiN3Z3a3hhb1NYaFNyNmRtU2VRRVFhdFBsN0JabkxJZ2ZSMTd3SGxaM0pnT3ZFK3R3cGM4QXoyeENwZnRVbDhvcFZpS1daU3MwajNVbkY1b05YdlJpSkt4ampKNGY5eklhM
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 78 68 55 46 42 78 4f 47 78 31 62 31 4e 6f 5a 31 59 72 57 45 67 31 5a 32 6b 78 4b 31 56 68 4b 30 78 47 4d 55 5a 57 63 6b 30 34 4d 6c 4a 71 65 57 56 4b 54 58 5a 69 57 47 39 44 64 6b 78 76 55 46 6c 56 4d 30 70 77 62 30 46 77 56 6d 39 45 59 54 5a 77 61 31 42 77 5a 45 78 75 4d 30 39 45 57 55 55 72 4b 7a 5a 31 65 57 74 30 63 33 5a 6f 4d 32 4e 48 55 55 74 48 57 45 77 32 56 45 5a 75 4d 45 5a 7a 55 46 42 77 52 48 4e 6b 57 57 4a 35 56 56 5a 35 52 6b 35 6b 52 48 64 4b 54 47 55 35 61 45 56 6b 4d 6a 64 6c 63 58 5a 4a 52 45 46 30 51 56 4a 51 52 58 52 33 64 58 68 6e 65 45 46 69 56 6a 64 30 5a 6a 52 30 4d 6d 31 4e 54 56 64 6f 53 6a 4a 5a 62 47 59 32 53 6e 42 57 64 6b 38 78 64 57 6c 53 5a 32 46 52 4e 6e 56 52 4e 55 4e 54 56 44 6c 6b 51 30 4a 36 54 58 45 76 4d 32 35 6b 55 Data Ascii: xhUFBxOGx1b1NoZ1YrWEg1Z2kxK1VhK0xGMUZWck04MlJqeWVKTXZiWG9DdkxvUFlVM0pwb0FwVm9EYTZwa1BwZExuM09EWUUrKzZ1eWt0c3ZoM2NHUUtHWEw2VEZuMEZzUFBwRHNkWWJ5VVZ5Rk5kRHdKTGU5aEVkMjdlcXZJREF0QVJQRXR3dXhneEFiVjd0ZjR0Mm1NTVdoSjJZbGY2SnBWdk8xdWlSZ2FRNnVRNUNTVDlkQ0J6TXEvM25kU
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 74 69 59 6d 31 59 61 6a 68 4d 57 57 56 48 51 6b 4e 51 63 57 4e 50 4d 45 78 30 62 6e 46 45 51 6a 6c 47 5a 6a 64 74 62 48 52 71 61 33 4a 75 57 47 6c 69 64 6b 64 71 56 30 68 56 56 56 56 53 4d 54 56 43 62 30 39 6d 53 46 68 71 65 6e 67 32 4e 47 4a 6f 64 69 38 72 62 58 42 47 56 33 6b 34 57 6d 78 31 52 58 46 4e 52 56 5a 4b 63 47 68 5a 52 7a 56 52 51 32 46 54 59 6a 5a 68 53 6a 4a 55 4d 6e 70 4b 63 32 64 6c 52 6d 4a 33 55 55 70 75 63 44 68 76 51 32 46 4a 63 44 42 31 64 7a 5a 6b 57 48 52 68 56 46 52 75 55 55 34 7a 4b 32 67 30 55 6a 42 70 5a 31 52 71 4d 45 46 56 52 6c 49 34 55 32 56 4f 5a 58 6c 69 4e 57 6c 49 63 44 64 49 64 58 4d 30 54 45 74 6d 51 57 4e 6f 5a 57 52 33 55 44 5a 50 4f 56 4e 55 51 56 42 5a 53 32 46 59 56 46 45 78 5a 30 74 74 62 57 63 32 59 54 68 43 54 Data Ascii: tiYm1YajhMWWVHQkNQcWNPMEx0bnFEQjlGZjdtbHRqa3JuWGlidkdqV0hVVVVSMTVCb09mSFhqeng2NGJodi8rbXBGV3k4Wmx1RXFNRVZKcGhZRzVRQ2FTYjZhSjJUMnpKc2dlRmJ3UUpucDhvQ2FJcDB1dzZkWHRhVFRuUU4zK2g0UjBpZ1RqMEFVRlI4U2VOZXliNWlIcDdIdXM0TEtmQWNoZWR3UDZPOVNUQVBZS2FYVFExZ0ttbWc2YThCT
2024-01-15 23:16:57 UTC	734	IN	Data Raw: 74 70 5a 54 4a 4c 61 31 6c 79 54 47 68 51 65 6a 56 75 61 6d 64 33 64 31 56 6e 59 6d 68 58 4d 32 39 72 54 6e 42 4e 51 54 56 46 65 6b 51 32 61 57 35 77 65 46 4a 4e 62 6b 5a 70 4e 6d 63 31 52 33 63 35 63 6d 4a 44 4e 56 42 30 64 43 39 35 4d 31 64 53 52 6b 4a 55 61 6c 49 77 52 44 42 61 4f 54 6c 74 5a 6b 35 4b 4d 55 35 32 54 69 74 4f 4e 58 70 74 55 55 78 43 65 45 51 78 62 32 6c 76 62 32 30 30 56 45 5a 48 4f 54 49 7a 63 56 51 32 52 48 4a 31 59 30 67 7a 55 7a 68 7a 65 47 63 77 65 45 4a 76 62 46 67 34 64 54 68 53 51 54 68 32 51 6e 70 32 61 6a 42 35 51 6a 52 4b 55 47 67 7a 52 6b 68 69 56 6d 4e 4e 59 56 68 31 4c 31 46 55 59 57 77 32 62 30 35 6a 55 47 39 33 4e 47 46 6c 59 32 56 6d 65 46 6c 5a 53 32 4a 42 4d 6d 38 31 62 53 74 35 61 6c 70 51 4d 46 41 76 61 55 4a 4a 61 Data Ascii: tpZTJLa1lyTGhQejVuamd3d1VnYmhXM29rTnBNQTVFekQ2aW5weFJNbkZpNmc1R3c5cmJDNVB0dC95M1dSRkJUalIwRDBaOTltZk5KMU52TitONXptUUxCeEQxb2lvb200VEZHOTIzcVQ2RHJ1Y0gzUzhzeGcweEJvbFg4dThSQTh2Qnp2ajB5QjRKUGgzRkhiVmNNYVh1L1FUYWw2b05jUG93NGFlY2VmeFlZS2JBMm81bSt5alpQMFAvaUJJa
2024-01-15 23:16:57 UTC	1252	IN	Data Raw: 31 31 65 31 0d 0a 6c 75 56 43 39 34 53 44 46 31 5a 48 4e 54 62 57 59 72 56 56 5a 43 4e 6d 4e 54 52 6b 64 6c 57 48 68 76 53 57 4a 4b 61 6e 70 43 54 53 74 31 51 30 6b 34 52 31 42 32 4e 32 6c 7a 56 6a 5a 44 4d 32 6c 72 51 6a 56 7a 61 57 6b 31 5a 56 4e 35 4d 32 35 73 55 44 46 54 59 58 45 30 5a 6a 56 73 62 7a 4e 45 62 45 56 43 63 6d 73 32 56 6c 51 35 62 56 56 70 5a 55 46 35 64 47 31 45 5a 30 56 61 4e 54 64 73 55 31 52 33 62 54 64 30 63 33 49 31 62 6d 39 4b 54 6e 56 6a 51 54 64 32 4b 79 39 5a 5a 56 6c 76 55 30 64 30 52 6e 68 30 52 6e 4e 4b 52 6c 68 54 63 33 68 36 59 55 5a 73 53 31 4e 58 61 6d 64 4f 4d 6c 46 61 55 7a 4e 78 51 6b 31 7a 61 6a 68 4c 4e 45 34 7a 59 57 77 72 63 6e 64 6f 55 32 64 32 62 58 63 31 54 44 42 32 56 6a 5a 57 5a 6d 4e 79 52 6a 4e 4b 64 6b 55 Data Ascii: 11e1luVC94SDF1ZHNTbWYrVVZCNmNTRkdlWHhvSWJKanpCTSt1Q0k4R1B2N2lzVjZDM2lrQjVzaWk1ZVN5M25sUDFTYXE0ZjVsbzNEbEVCcms2VlQ5bVVpZUF5dG1EZ0VaNTdsU1R3bTd0c3I1bm9KTnVjQTd2Ky9ZZVlvU0d0Rnh0RnNKRlhTc3h6YUZsS1NXamdOMlFaUzNxQk1zajhLNE4zYWwrcndoU2d2bXc1TDB2VjZWZmNyRjNKdkU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.5	50500	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:57 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZW-frqQw4WUZeVPixA1V_SlN1wE78sksXpvxHVJq9tE3jboLLPnL3RBt6DBak-5cRM2XW0bI2kjGJ1msww; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:16:57 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Mon, 15 Jan 2024 23:16:57 GMT Expires: Mon, 15 Jan 2024 23:16:57 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:57 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-01-15 23:16:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.5	50503	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 2925 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:58 UTC	2925	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6f 36 75 68 2b 6f 42 4f 41 41 41 41 3a 4b 31 63 44 38 71 33 6e 66 71 48 55 30 72 6f 38 67 75 77 67 53 68 63 4f 6f 62 6d 36 34 54 4b 79 59 31 37 53 39 39 65 38 30 43 6b 37 4a 73 38 52 56 51 79 30 48 5a 49 46 67 77 66 41 46 79 69 71 6a 37 4a 30 7a 47 55 57 45 6c 54 78 72 4a 38 50 32 42 2b 71 36 4e 7a 70 6f 65 4b 38 51 73 72 6c 53 79 75 57 61 6f 52 4d 46 75 6d 7a 42 72 39 36 78 52 59 59 44 46 69 70 64 38 50 5a 70 76 76 70 70 78 66 35 68 37 2f 79 64 41 58 47 30 59 54 79 63 4c 43 32 4b 56 4a 33 74 30 6a 61 52 57 43 70 70 76 49 76 6b 35 37 4c 6d 67 64 37 78 75 43 66 68 2f 52 52 30 55 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAo6uh+oBOAAAA:K1cD8q3nfqHU0ro8guwgShcOobm64TKyY17S99e80Ck7Js8RVQy0HZIFgwfAFyiqj7J0zGUWElTxrJ8P2B+q6NzpoeK8QsrlSyuWaoRMFumzBr96xRYYDFipd8PZpvvppxf5h7/ydAXG0YTycLC2KVJ3t0jaRWCppvIvk57Lmgd7xuCfh/RR0U
2024-01-15 23:16:58 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1565 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:16:58 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcea-4ebb879e28a12b22451f7dcd X-Cache: Miss from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 9TpPXifnd8BYscMkMJZk9vJll1Fui5Js0jpybk_WKKxMpz89FgOJXg==
2024-01-15 23:16:58 UTC	1565	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 67 41 2b 69 35 78 38 67 41 41 41 41 3a 38 42 6a 58 59 55 5a 68 56 45 50 78 69 6e 70 53 6f 45 61 38 36 58 77 34 5a 62 61 7a 38 4d 38 4a 30 72 6b 6d 6f 6a 7a 58 34 55 67 63 4a 41 6a 62 44 69 33 6e 58 71 4d 49 76 42 73 61 49 51 47 36 2b 44 50 37 46 35 2b 61 34 51 32 31 63 32 46 6b 63 4f 39 52 55 4b 2f 74 55 76 69 76 4a 55 75 4e 6e 55 48 53 64 31 53 31 64 52 6e 6f 39 54 62 4b 71 65 35 57 72 70 63 6b 4e 6a 6d 6b 6b 78 59 33 38 37 64 64 6d 78 6d 6b 73 6c 50 6a 4c 6b 2b 67 6d 73 79 59 41 46 31 71 68 45 41 48 79 58 38 44 54 70 4d 69 68 41 43 41 5a 72 51 31 66 66 6b 61 61 55 6a 6f 4a 6a 4b 4c 61 61 44 41 2b 6a 75 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+ju

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.5	50504	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	2046	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0
2024-01-15 23:16:59 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:58 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b140d5b0fbed1dab248b0959f44a7944.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: BGo3ygEkB_okRdw14vtBVts8AHjEu9-KRkty8Xf-LDKDU44jDsYOBQ==
2024-01-15 23:16:59 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.5	50508	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	3247	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3006&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:16:59 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:59 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bdefa3b51eed0260&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIwZU0yURnq1ZNioOLdgc1cN8TW1aP7lRc x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f9efe5e72b7e5cc47bf34a0b0debcbe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 4ZV_MmDa27tV5C8s88-Kl_H1qO049itHZwkzWUpwc7DGJ6H9ThxwJw==
2024-01-15 23:16:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.5	50506	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	452	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:58 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 28 Dec 2023 21:11:24 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 749e1450fdc7cac18bb91a34e80053aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NolNsFraMVrJOkX3L_LlCKLKkww-vj1QTV9MsiPgDJDv-sBvZZeRpg== Age: 1562734
2024-01-15 23:16:58 UTC	16384	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-01-15 23:16:59 UTC	14236	IN	Data Raw: ad 6e e9 56 69 62 a0 5e 4f 1a 5b c0 e2 69 5e 3e 72 0a e5 47 ae 48 22 8b 77 25 5e e7 a5 e8 d7 49 6b a3 c0 16 46 e9 8c 0f bc ed fc ea b9 d2 75 5d 42 fe 59 2e 16 28 21 04 14 8c b6 7f 13 8e ff 00 8d 59 f0 c4 d6 d2 59 45 a8 4d 0b 0d f9 31 c6 07 11 af f8 d2 6a de 26 06 e6 68 2d 23 0b c8 52 db c7 7f 61 cd 34 cd 6c ba 1a e3 49 49 6d 96 49 dd 9d 93 18 2a 76 f1 55 75 0b 4b 0d 5a d1 6e 66 b5 86 69 6d 9c db b9 74 0c 46 3a 75 fc 0f e3 57 0d ec 83 4f 65 0e 17 09 d9 70 3a 7a 9a e3 74 2d 66 48 bc 4b ad e9 37 2e 4a 5d 44 2e a1 27 fb c1 46 7f 41 fa 56 75 13 56 97 62 93 5b 77 23 bf d0 b4 26 61 e6 e9 d0 8c f7 4c a1 fd 2b 12 7f 0b 68 d7 13 18 a1 7b 9b 62 7e eb 07 de a7 f3 ae a6 f8 c7 3c 0c 06 37 0e 45 72 e2 ed e2 9d d5 cf cb da b4 bb 21 a4 64 5f 7c 3f b8 00 b5 a5 fc 53 0f ee Data Ascii: nVib^O[i^>rGH"w%^IkFu]BY.(!YYEM1j&h-#Ra4lIImI*vUuKZnfimtF:uWOep:zt-fHK7.J]D.'FAVuVb[w#&aL+h{b~<7Er!d_\|?S
2024-01-15 23:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.5	50507	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:16:58 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:16:58 GMT X-Cache: Error from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: pNJ7rlKKvRDQwEJ1dsCM5TVO-sjL97H2Xy8ymsrfc1CeNYDLly5rQQ==
2024-01-15 23:16:58 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.5	50505	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:58 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:16:59 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:59 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=af0ca3b56e4b008d&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvYOq2ANrfVw_C7bXvKTN1TTs5Wsvp4dl4 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f9efe5e72b7e5cc47bf34a0b0debcbe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 5wUQoEMYCIpdRLatT_BN6iCYBv_YH75wOPb_7m4J-T3I_rK08x9S0w==
2024-01-15 23:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.5	50509	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:16:59 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:59 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a87ea3b58e440120&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGYVKRamb4XOKlZN1ZzTbyLLuvczZE-lQrg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fba666ceffdeb316c8edf476d8994bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: y8fsNqP0BMev9bOTc5_C3U4_po_-5rmmGQmbLzXZgF41sGB84mEVDQ==
2024-01-15 23:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.5	50511	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	2517	OUT	GET /gampad/ads?pvsid=425093426163751&correlator=3649591904724868&eid=31079956%2C31080289%2C95320409%2C31080328%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202401080101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D7e7e2bed-860d-4ab7-afec-134d13ba8999%26affiliate_id%3D304142%26rendered_ad_pageview_id%3Df667a3ac68470510%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3Df927aa320290b431%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ&gpic=UID%3D00000db788c26b0e%3AT%3D1705360584%3ART%3D1705360584%3AS%3DALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA&abxe=1&dt=1705360607284&lmt=1705360607&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=810723182.1705360577&ga_sid=1705360607&ga_hid=232771328&ga_fc=true&ga_cid=1111547412.1705360577&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1705360600687&idt=1331&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=2692388390&frm=20 HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:16:59 UTC	771	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Google-LineItem-Id: 6409064327 Google-Creative-Id: 138453373351 Google-MediationGroup-Id: -2 Google-MediationTag-Id: -2 Date: Mon, 15 Jan 2024 23:16:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/plain; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:16:59 UTC	481	IN	Data Raw: 38 30 30 30 0d 0a 7b 22 2f 33 31 30 32 2f 62 63 6f 6d 2d 77 77 77 2f 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 2f 69 6e 64 65 78 2f 69 6e 64 65 78 2d 70 72 69 6d 61 72 79 22 3a 5b 22 68 74 6d 6c 22 2c 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 31 2c 30 2c 30 2c 30 2c 30 2c 22 68 65 69 67 68 74 22 2c 6e 75 6c 6c 2c 31 2c 31 2c 6e 75 6c 6c 2c 5b 31 33 38 34 35 33 33 37 33 33 35 31 5d 2c 5b 36 34 30 39 30 36 34 33 32 37 5d 2c 5b 35 32 30 37 32 35 30 39 32 37 5d 2c 5b 33 32 36 35 37 35 30 39 33 34 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 37 36 34 31 38 38 5d 2c 5b 31 32 32 38 39 35 38 37 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 4f 72 59 47 73 6c 32 71 38 52 Data Ascii: 8000{"/3102/bcom-www/accommodations/index/index-primary":["html",1,null,null,1,0,0,0,0,"height",null,1,1,null,[138453373351],[6409064327],[5207250927],[3265750934],null,null,[764188],[12289587],null,null,null,0,null,null,null,null,null,null,"AOrYGsl2q8R
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 41 41 2d 56 34 71 50 4b 66 31 76 71 77 36 4f 43 4f 2d 36 6d 54 4a 63 48 4c 63 68 75 42 75 69 68 33 32 37 38 47 34 66 75 46 5f 42 7a 6f 4a 68 73 30 6f 35 71 34 7a 6f 50 37 70 51 7a 39 63 59 50 4b 76 44 37 76 61 41 48 47 4b 36 6a 65 4f 62 49 33 32 69 72 50 51 61 69 6b 5f 79 32 47 4c 47 42 2d 50 58 44 74 31 73 6e 6a 32 6c 5f 74 71 4c 34 38 69 70 72 62 5f 41 31 42 57 48 61 43 32 38 46 72 51 4f 6e 52 57 36 67 6e 45 78 2d 6c 62 4d 44 56 6c 6b 4e 49 48 2d 75 33 69 42 6d 77 4d 79 36 68 48 68 48 44 5f 41 33 30 76 4f 41 46 64 59 41 41 45 4c 56 57 67 4f 42 59 5f 6c 4e 46 6c 51 46 6c 7a 6e 71 4d 57 65 41 38 39 43 78 2d 54 5f 79 6b 74 69 30 77 59 4f 6f 4b 4e 63 34 66 50 50 45 48 38 6b 34 5f Data Ascii: null,null,null,null,null,"AA-V4qPKf1vqw6OCO-6mTJcHLchuBuih3278G4fuF_BzoJhs0o5q4zoP7pQz9cYPKvD7vaAHGK6jeObI32irPQaik_y2GLGB-PXDt1snj2l_tqL48iprb_A1BWHaC28FrQOnRW6gnEx-lbMDVlkNIH-u3iBmwMy6hHhHD_A30vOAFdYAAELVWgOBY_lNFlQFlznqMWeA89Cx-T_ykti0wYOoKNc4fPPEH8k4_
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 69 67 6e 3a 6c 65 66 74 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 31 30 30 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 Data Ascii: ign:left;cursor:pointer;font-family:inherit;text-decoration:none;box-sizing:border-box;vertical-align:middle;position:relative;-webkit-tap-highlight-color:transparent;border-radius:var(--bui_border_radius_100);background:transparent;font-size:var(--DO_NOT
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 75 73 2c 2e 42 75 74 74 6f 6e 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 59 75 30 6e 74 3a 68 6f 76 65 72 2c 2e 42 75 74 74 6f 6e 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 59 75 30 6e 74 3a 6c 69 6e 6b 2c 2e 42 75 74 74 6f 6e 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 59 75 30 6e 74 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 42 75 74 74 6f 6e 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 59 75 30 6e 74 3a 6e 6f 74 28 2e 42 75 74 74 6f 6e 5f 72 6f 6f 74 Data Ascii: us,.Button_root--variant-primary-action__Yu0nt:hover,.Button_root--variant-primary-action__Yu0nt:link,.Button_root--variant-primary-action__Yu0nt:visited{color:var(--bui_color_on_cta_background)}.Button_root--variant-primary-action__Yu0nt:not(.Button_root
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 65 69 67 68 74 3a 31 30 30 25 7d 2e 53 74 61 63 6b 5f 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 6f 6c 75 6d 6e 5f 5f 54 74 5f 59 4a 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 7d 2e 53 74 61 63 6b 5f 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 5f 5f 4f 67 52 77 53 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 7d 2e 53 74 61 63 6b 5f 72 6f 6f 74 2d 2d 6e 6f 77 72 61 70 5f 5f 4c 78 65 61 38 7b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 7d 2e 53 74 61 63 6b 5f 72 6f 6f 74 2d 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 73 74 72 65 74 Data Ascii: eight:100%}.Stack_root--direction-column__Tt_YJ{flex-direction:column;align-items:stretch}.Stack_root--direction-row__OgRwS{flex-direction:row;flex-wrap:wrap;align-items:flex-start}.Stack_root--nowrap__Lxea8{flex-wrap:nowrap}.Stack_root--align-items-stret
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 54 65 78 74 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 62 6f 64 79 5f 32 5f 5f 47 6a 69 55 35 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 Data Ascii: _small_font_strong_1_font-family)}.Text_root--variant-body_2__GjiU5{font-size:var(--DO_NOT_USE_bui_small_font_body_2_font-size);font-weight:var(--DO_NOT_USE_bui_small_font_body_2_font-weight);line-height:var(--DO_NOT_USE_bui_small_font_body_2_line-height)
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 31 5f 5f 6c 5f 6a 70 66 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 Data Ascii: 1__l_jpf{font-size:var(--DO_NOT_USE_bui_medium_font_small_1_font-size);font-weight:var(--DO_NOT_USE_bui_medium_font_small_1_font-weight);line-height:var(--DO_NOT_USE_bui_medium_font_small_1_line-height);font-family:var(--DO_NOT_USE_bui_medium_font_small_1
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 3a 32 30 30 3b 2d 2d 62 75 69 5f 7a 5f 69 6e 64 65 78 5f 33 3a 33 30 30 3b 2d 2d 62 75 69 5f 7a 5f 69 6e 64 65 78 5f 34 3a 34 30 30 3b 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 64 75 72 61 74 69 6f 6e 3a 30 2e 31 35 73 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 69 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 30 2e 32 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 6f 75 74 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 31 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 69 6e 2d 6f 75 74 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 75 62 74 6c 65 2d 69 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 Data Ascii: :200;--bui_z_index_3:300;--bui_z_index_4:400;--bui_animation_duration:0.15s;--bui_easing-slow-in:cubic-bezier(0,0,0.2,1);--bui_easing-slow-out:cubic-bezier(0.4,0,1,1);--bui_easing-slow-in-out:cubic-bezier(0.4,0,0.2,1);--bui_easing-subtle-in:cubic-bezier(0
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 72 5f 64 69 73 61 62 6c 65 64 3a 23 36 62 36 62 36 62 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 66 66 35 63 35 63 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 36 39 63 65 36 66 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 74 72 61 6e 73 70 61 72 65 6e 74 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 23 32 36 32 36 32 36 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 74 61 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 37 31 63 32 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 Data Ascii: r_disabled:#6b6b6b;--bui_color_destructive_border:#ff5c5c;--bui_color_constructive_border:#69ce6f;--bui_color_background:#d9d9d9;--bui_color_transparent:transparent;--bui_color_background_alt:#262626;--bui_color_cta_background:#0071c2;--bui_color_backgrou
2024-01-15 23:16:59 UTC	1252	IN	Data Raw: 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 23 66 66 35 63 35 63 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 23 36 39 63 65 36 66 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 5f 61 6c 74 3a 23 34 39 34 39 34 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 66 6f 72 65 67 72 6f 75 6e 64 3a 23 61 33 64 37 66 63 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 3a 23 30 30 37 31 63 32 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 73 65 63 6f 6e 64 61 72 79 5f Data Ascii: ui_color_destructive_foreground:#ff5c5c;--bui_color_constructive_foreground:#69ce6f;--bui_color_foreground_disabled_alt:#494949;--bui_color_brand_primary_foreground:#a3d7fc;--bui_color_action_foreground_inverted:#0071c2;--bui_color_brand_genius_secondary_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.5	50512	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:16:59 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:59 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4bffa3b5a7a700ac&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvWDrAgTCLM4wWmfCpUHUQlsNDgrZkrOrU x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: mT6HcAnKau2_zbKYxF2_5FBskC-aNBIJVWDuSsFRXJXsvoTrLcZa4w==
2024-01-15 23:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.5	50513	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	843	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&cb=1705360608473&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZXTFBiREo4dERVd1VxTFdBYW9GaDJTVUtKV3BURHhmSVJiNVJLUkNXS3U0Y3E2L2d3R2s0MWRhN01TeUkxYVdhb1FIVTQxNXZ0KzFxdGJCdTJlM1BsSnFIeDgyWFppSTViTjBFYlMxb3dvUT0meWpoU2dmUkR5Q3Fxc3I1SVBZYkFDMlI0Tlg4PQ=="
2024-01-15 23:16:59 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 1105343210397629 Date: Mon, 15 Jan 2024 23:16:59 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:59 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.5	50516	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	3885	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:16:59 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:16:59 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a55ca3b514ae00bc&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIQM9Qi7qmuF0J6-QH1pRK043jMnINEDoI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 041a4887d523cabe8177e269cc358162.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: hzAO8rarYDZmJdoFJIa8PT4AOedcnpdSAivHemd6wLeyBsfapOqZtg==
2024-01-15 23:16:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.5	50514	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	1610	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=63395ea6-3749-4b67-883b-6eaa54a6664d&u_sclid=e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f&u_scsid=1a065792-be81-49f6-b178-47e74a8775d1&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=3329&m_fcps=3006&m_pi=3312&m_pl=6960&m_pv=2&m_rd=8599&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&trackId=2cfd8eee-8e7d-4b46-a553-5748470cbd20&ts=1705360608302&v=3.8.0-2401042024 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:59 UTC	485	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:16:59 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:16:59 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.5	50515	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	784	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360608474&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZXTFBiREo4dERVd1VxTFdBYW9GaDJTVUtKV3BURHhmSVJiNVJLUkNXS3U0Y3E2L2d3R2s0MWRhN01TeUkxYVdhb1FIVTQxNXZ0KzFxdGJCdTJlM1BsSnFIeDgyWFppSTViTjBFYlMxb3dvUT0meWpoU2dmUkR5Q3Fxc3I1SVBZYkFDMlI0Tlg4PQ=="
2024-01-15 23:16:59 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 303 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1798503899793559 Date: Mon, 15 Jan 2024 23:16:59 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:16:59 UTC	303	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 66 61 6c 73 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":false,"isUtilizingAdvertiser1pEn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.5	50517	216.239.34.21	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	2957	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je41a0z879615461&_p=1705360606642&gcs=G1--&gcd=11l1l1l1l5&dma=0&cid=810723182.1705360577&ul=en-us&sr=1280x1024&ur=US-NC&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&sst.uc=US&sst.rnd=50931350.1705360608&sst.gcd=11l1l1l1l5&sst.tft=1705360606642&_s=1&sid=1705360585&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8521&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0
2024-01-15 23:16:59 UTC	474	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: 463da7ad1917d91506382e01b156be8f Date: Mon, 15 Jan 2024 23:16:59 GMT Server: Google Frontend Content-Length: 65 Expires: Mon, 15 Jan 2024 23:16:59 GMT Connection: close
2024-01-15 23:16:59 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.5	50518	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	725	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1229 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:16:59 UTC	1229	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 30 34 63 63 62 37 64 39 2d 63 38 38 64 2d 34 39 32 62 2d 61 62 37 31 2d 65 39 38 62 30 38 31 65 66 65 35 32 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"04ccb7d9-c88d-492b-ab71-e98b081efe52","ss":"1a065792-be81-49f6-b178-47e74a8775d1","df":true,"s
2024-01-15 23:17:00 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:00 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.5	50519	172.253.115.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	1153	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=460620828.1705360583;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:17:00 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"15523521832281590314"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x39993e2a081a16af","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xac1250a68b1dd859","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0x5fb8c1da25d77b05","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x9e5e37f5fa5f32a2","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11707336131466150419","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"15523521832281590314","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"15523521832281590314","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"15523521832281590314","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"15523521832281590314","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Wed, 14-Feb-2024 23:17:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.5	50520	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	789	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_IIz2dK4FKIiOPT1_TLlWCJh110njpmcKCcLaLfAgEwoSW5mM&random=246440793 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.5	50522	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:16:59 UTC	446	OUT	GET /xdata/images/city/170x136/976784.jpg?k=717a6a83ea61edb06017bb8c9bd3d36511ec0e1aef59ac94235584d4fd1709cb&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5364 Connection: close Server: nginx Date: Fri, 29 Dec 2023 04:55:14 GMT ETag: "1e29d071ab764beece3862fd5d8a1fc1fc3f9b64" Content-Language: 5364 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: nmdAXb0O2PedV1_VD99B2kDnq1rsj35mmj6PMoRAjAxZDLeEnbSJow== Age: 1534906
2024-01-15 23:17:00 UTC	5364	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.5	50525	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	446	OUT	GET /xdata/images/city/170x136/976870.jpg?k=4bb231f86e973cac2971077b1664c1374fc0d718c95634b4cb01ae4550262f23&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5571 Connection: close Server: nginx Date: Fri, 22 Dec 2023 12:01:52 GMT ETag: "2daca33e79a04a025f341e9a2b6f4313d5f649c9" Content-Language: 5571 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2b74e5ee4d30afba8f9df9907896c5f4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Fn-ZtGBHG1LbR8lkuftvjX8JLKs0__3d0txNYr_YjCL3-52oOMCoQA== Age: 2114108
2024-01-15 23:17:00 UTC	5571	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.5	50538	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	3412	OUT	GET /js_errors?pid=f667a3ac68470510&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSMJcbBIfVNVWZfdPceCHO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:00 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=46bba3b6be350060&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpI4yYBR61Qg4qkQlU8U2qCxeRESr-Hx7R x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: TkO0PyvX4mPP3ipWTznOwPgOs2MBgkEau_NTX8i4zFg30p7IUayIaA==
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.5	50540	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	3007	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=f667a3ac68470510&ete=&etg=&etcg=&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,NVFVcfTbdNNWNCEJbWXNYTUcCcCcCC\|2&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:00 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=14f8a3b6af64009a&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL6560vuPOg02E9iP-jhtjLJaCZXgmhCqs x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f2c051917a765f1d1a1cd2ce1622adb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: VlNmTQjvuoyhkH879RLi3GK69O6oKM-49WK8SAgJKJA6BtH59Cy5iQ==
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.5	50542	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	3251	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:00 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5740a3b63c0500cb&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLxDTTHIGKrkyu4gtFx0tPJHIbkyHUOiGA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: LAVo1qAp-pZWGBrxzBAKu8MbzEoyQscPjxyk5z7jNbF5MYrP4jnoKg==
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.5	50523	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1290	OUT	GET /pagead/1p-user-list/988382855/?random=1705360607644&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZYNBEMPIrA4HrSoXQRak8eVNRjEZFwy2XdfHFzpIgHMySXsA&random=825179981&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.5	50526	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	446	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Fri, 22 Dec 2023 11:30:54 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: nyV6Y5-5GPSk58NleXOE5rw4VJjD9UW1_57MsmXb2Y6d3nAx-oxC4Q== Age: 2115966
2024-01-15 23:17:00 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.5	50534	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:00 GMT X-Cache: Error from cloudfront Via: 1.1 09028890675e48687e2855f3bdad98ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: YH_jvgC1nkQfzlCCxZNi1IyrVMjTBy_TmGHPNrTOnhtOXdHbn1zt3g==
2024-01-15 23:17:00 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.5	50524	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1143	OUT	GET /pcs/view?xai=AKAOjstaJaz9LOOKdBcDy-HX58Pd_OdrkFizc7Wk3Ed0kTU0w6he5ZcGBG-l2_lMqD6p3toJsUsUymJT0lp2oKRdX2Br8y72AiDEyAbE6Cudq1SOcXRRaZ-WIliy1EjDuyN1i8Ne8ebenRUuFnOjqKiz_lW5v304ypJ5LzFqmaU8Hucj19u6kjwdlf4mIc_10hDEX70s_J-S2e44GsJ0h67_3KjFhnpd9XDJGkGoz4qvAw_fQ6peMxUis006ncMXU3fRS4fM7_kzxnEq_t31mfdlv-yvnsKzTFI_MpixuKO6Eti3fdZJ3CCNTv-7sWoEvZy_uG-YALASsSmR8duQhi9MK7GYHUuI-XIFObevtHbdtk_JzpRl5AgQ1zIwA7iat2Xk-1g&sai=AMfl-YSjXmNjRUtOjvUvteV7qgXovMmHQsfRPA9ZJlHatcDEFPNhb3pHVK3Np12rv4QEGJxVqOCVXnDaSkJ2o9xTZ-kBJPBTYjCfFpP07_Fdhu1qceh5A9WPjjzKXUQvy1s&sig=Cg0ArKJSzK0sR0B0mMjiEAE&uach_m=%5BUACH%5D&urlfix=1&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:17:00 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:17:00 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.5	50528	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1247	OUT	GET /ddm/fls/z/dc_pre=CIG7s6rD4IMDFcHxKAUd7SsBLA;src=4228414;type=views;cat=views;ord=3822600719901;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=WFvK9uf1Sp-HiPg5Bwat9g;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065a5bcb805093c99d94ccf114c54497f_1705359600;ps=1;pcor=1533091234;gtm=45He41a0v79615461;gcd=11l1l1l1l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.5	50539	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2046	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0
2024-01-15 23:17:00 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 281687fdef6568ba75a1a090e3b48e2a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: 3N6gsegpP5mQN07zTRS-tG_FUMyldi5gbCt1dba438eYbpVKL0Zdjg==
2024-01-15 23:17:00 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.5	50521	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1715	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1705360608552 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZXTFBiREo4dERVd1VxTFdBYW9GaDJTVUtKV3BURHhmSVJiNVJLUkNXS3U0Y3E2L2d3R2s0MWRhN01TeUkxYVdhb1FIVTQxNXZ0KzFxdGJCdTJlM1BsSnFIeDgyWFppSTViTjBFYlMxb3dvUT0meWpoU2dmUkR5Q3Fxc3I1SVBZYkFDMlI0Tlg4PQ=="
2024-01-15 23:17:00 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:17:00 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 6036641516780160 Date: Mon, 15 Jan 2024 23:17:00 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.5	50537	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1366	OUT	GET /pcs/view?xai=AKAOjssuuyEimnOFHYONpl9q3qG6bZnU-mYQAbmN5jkMZjV1wAvXUo_89xQc79NFyskLRevLeOnoUXU48PoT5m07KBopyHfHfzDt1YbuBLqx6emRODKyz-uMnlW5GOCKVIB1pvdAybdCUijEExOw49atqFyUvnA7if89zYhGyDpH-dn2uHaDFGcAGx-vmw_9RWZWpbBJ4uIsp9oqC9e-i9Tsj5bvYEZohoo887fYdD1idwObnVFH1AeNXdOKfQIJFrkHHt3IUfgNEPXhe9jLLNkWr0-c1YLRNP6UFn8kzGYGuiXt6ZTrQrbV2E7Fz6V3ezQ3M83_g2Vt-765JJ56VD1G4Ml8Jy4MlcRVqB7_7x8_q62X2DmkrjwMH41hNiO6psxK5f5rMQ&sai=AMfl-YRB7wGPIRqruL7PAJVTPt0VYTpuc-gE8FO-_ylC2YsL10i7BVcuaKGK94dvSXiTLZcm3S7gRWLpzaolMqSD_4L9XY02Yb1G26B9-3MwuVJQz6Qx_Cf0rAY7ZxqX2VE&sig=Cg0ArKJSzGvHNHMTX6SfEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0%3D&adurl= HTTP/1.1 Host: securepubads.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; IDE=AHWqTUl7ic8v82Uz_Y7AAn1xXXBDS2UTE6qUVag_uxcPqKd-QFg0gaEROa0OdUNE
2024-01-15 23:17:00 UTC	792	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-WoW64 Cache-Control: private Access-Control-Allow-Origin: * Content-Type: image/gif X-Content-Type-Options: nosniff Date: Mon, 15 Jan 2024 23:17:00 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.5	50536	151.101.128.84	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1919	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1705360609076&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%2243c0095c%22%2C%22is_eu%22%3Afalse%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZXTFBiREo4dERVd1VxTFdBYW9GaDJTVUtKV3BURHhmSVJiNVJLUkNXS3U0Y3E2L2d3R2s0MWRhN01TeUkxYVdhb1FIVTQxNXZ0KzFxdGJCdTJlM1BsSnFIeDgyWFppSTViTjBFYlMxb3dvUT0meWpoU2dmUkR5Q3Fxc3I1SVBZYkFDMlI0Tlg4PQ=="
2024-01-15 23:17:00 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Tue, 14 Jan 2025 23:17:00 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSYvYmhoY2w0SGFTN3hoanlPQmYrQmhjM2JFeFlZRjZLaFovNmNVNkppMU1FZFZ5TVRER1kwL2RSZVpzSUYzV0VyaFVmdFR5dTMrMkJWMzJGRUwrVHQ0MGl2KzlqUWZYMmJOV3J3ajdNZlZCVT0mVFdPQThKWWVLcC9CQWNpYXFFVC9TTVdCQll3PQ=="; Expires=Tue, 14 Jan 2025 23:17:00 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 3353935448785328 Date: Mon, 15 Jan 2024 23:17:00 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: 9386892386b62585d2cc0c45f8ac8977ddee7bec
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.5	50535	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	451	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 14:48:53 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 65515d7b1028cd133489fb761d35fa06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: GcWmG-_tcK2OcKBMfAHkKgYqmNXExCWFqff06qwr67_6V5ByPGMqEw== Age: 2104087
2024-01-15 23:17:00 UTC	10265	IN	Data Raw: 32 38 31 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2811JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:17:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.5	50543	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	3253	OUT	GET /js_tracking?pid=f667a3ac68470510&stype=1&lang=en-us&ref_action=index&ver=2&aid=304142&sid=0059242d4bafbe759210d4ea3ea582cb&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|8\|4&m=UmFuZG9tSVYkc2RlIyh9YZThsREdyT5R0YXrIOU8mmasIoQpSHoOWJLuNSDXe_bct2KGpUtOUNJWcSr0-6AOASAiIgefjxUG2PcQFacNJy40lCBkjxcbHPZap1uslKIEU1cCVt-L4yqbAJ7Fy4sCHuFyecGshd2vxqVCL4A5A5jDjKxwpAyERbz8jRx1yGyuJvcPm5eEXdPIsZsOWZGIu_uiVaoK8RJBCQzAuV8uQuev3iPSLXGgA7cWolz4bYdM5sNaf7-Pq0RcUoopiGfwNOSMcJy1Ad2nk_QHMh5tBVfVfsdcJROCLiaJyHS-D7Ls HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:00 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=cfd3a3b66efd017c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLiGTLcUmH-gHkd6iOvXCAWiY8akFTojYY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: x5dtKk37AfYkAyXDi2ySHmHJLxnhwO7awBYqwE7m4dwC_K2T-6j1Vg==
2024-01-15 23:17:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.5	50529	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:00 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6f5ea3b650650033&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVnvOSzNGCt3eWWmkl7XkQ5TW1SaSg1G1w x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: hOiF37lixEDUSh8q1kPzIwPgD1O_1wPSNb-59mvNU1zQkBYjHiPxRg==
2024-01-15 23:17:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.5	50546	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 3192 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	3192	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 67 41 2b 69 35 78 38 67 41 41 41 41 3a 38 42 6a 58 59 55 5a 68 56 45 50 78 69 6e 70 53 6f 45 61 38 36 58 77 34 5a 62 61 7a 38 4d 38 4a 30 72 6b 6d 6f 6a 7a 58 34 55 67 63 4a 41 6a 62 44 69 33 6e 58 71 4d 49 76 42 73 61 49 51 47 36 2b 44 50 37 46 35 2b 61 34 51 32 31 63 32 46 6b 63 4f 39 52 55 4b 2f 74 55 76 69 76 4a 55 75 4e 6e 55 48 53 64 31 53 31 64 52 6e 6f 39 54 62 4b 71 65 35 57 72 70 63 6b 4e 6a 6d 6b 6b 78 59 33 38 37 64 64 6d 78 6d 6b 73 6c 50 6a 4c 6b 2b 67 6d 73 79 59 41 46 31 71 68 45 41 48 79 58 38 44 54 70 4d 69 68 41 43 41 5a 72 51 31 66 66 6b 61 61 55 6a 6f 4a 6a Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJj
2024-01-15 23:17:00 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:17:00 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcec-0439acea28eab1c93e92c1fa X-Cache: Miss from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: TtF-BklKRd-EgVhAwONsMcQb-fyrLs5EESI2j8cEMvyZCnOXY9Bluw==
2024-01-15 23:17:00 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 63 2f 53 69 2b 77 67 53 41 41 41 41 3a 68 39 6d 71 64 6d 53 36 6f 33 54 4b 6f 78 37 4a 59 51 47 53 38 43 69 42 62 54 6b 62 31 63 6a 50 43 5a 49 44 6e 61 49 76 4b 5a 57 6a 56 74 42 49 61 7a 39 43 69 4a 58 4e 70 70 4a 6f 57 51 51 4b 74 46 50 68 61 55 73 65 7a 43 36 67 31 73 2b 58 35 6f 73 38 7a 62 33 2b 50 33 73 63 34 66 39 65 79 71 55 6a 4a 45 6c 62 55 61 32 41 32 64 73 31 37 31 41 48 56 6e 78 46 46 47 76 75 76 69 4a 43 2b 68 4c 44 6f 77 6d 2b 6c 76 79 72 69 47 6d 2f 6f 4c 6a 52 45 39 48 43 47 48 64 46 72 45 4c 4c 33 38 45 5a 37 6c 49 45 6e 76 66 6e 4d 59 44 54 43 46 77 69 32 77 67 74 7a 6f 4c 44 67 35 75 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAc/Si+wgSAAAA:h9mqdmS6o3TKox7JYQGS8CiBbTkb1cjPCZIDnaIvKZWjVtBIaz9CiJXNppJoWQQKtFPhaUsezC6g1s+X5os8zb3+P3sc4f9eyqUjJElbUa2A2ds171AHVnxFFGvuviJC+hLDowm+lvyriGm/oLjRE9HCGHdFrELL38EZ7lIEnvfnMYDTCFwi2wgtzoLDg5u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.5	50547	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2765	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:00 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e09da3b65c81006f&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_ve0JX5_B19J6kA9QGTxZhcNznLNIDmspBI x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A-OD0tQC8m_E6uL_KMLSQdjmbyTaT834JnYXoevPybMfQmN2ELY-Kg==
2024-01-15 23:17:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.5	50530	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	451	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Fri, 22 Dec 2023 16:09:20 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: u6uxXEj1kXYiR4gPVLqchxerojcgFkNcHs7cSwlS7Ul1npa0ckdpzA== Age: 2099260
2024-01-15 23:17:00 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-01-15 23:17:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.5	50532	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1730	OUT	GET /pagead/1p-user-list/1060768846/?random=1705360607860&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nLgKc4Gvv0EsDeQpdqIHAHnyK_RnOtlY9&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_J8dQ19nhGyvWNr45DULlOEUF2EILMmfQIlWNIQk6BYSaIomx&random=3820176364&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.5	50531	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1290	OUT	GET /pagead/1p-user-list/973712236/?random=1705360607901&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_3_cmDTS6kBH18CikhtE2wR7f3jd-lCUKV-yZpnqyl1fnNZHS&random=2600041176&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.5	50533	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1290	OUT	GET /pagead/1p-user-list/975716499/?random=1705360607982&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_ZNtCHK4WSUyPlt65YjyJIGPKlUPsYbV0cbaC5ylbAyBog22y&random=2403716807&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.5	50527	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1287	OUT	GET /pagead/1p-user-list/973712236/?random=1705360607937&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Fi636anKBXpCOS77ajXhwCig1tEr1GRkc0CPKwqLRhck4F8G&random=4885263&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.5	50549	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2046	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0
2024-01-15 23:17:00 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b140d5b0fbed1dab248b0959f44a7944.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: nHKGo8ooujAVdeXLOi5iejloKZgIbovKW5D0_TWlWFRXTNT-Wi6SsA==
2024-01-15 23:17:00 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.5	50548	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	1289	OUT	GET /pagead/1p-user-list/975716499/?random=1705360608028&cv=11&fst=1705359600000&bg=ffffff&guid=ON&async=1&gtm=45He41a0v79615461&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ%26sid%3D94b76ea7cb923e6da206675b5d1abbbd&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_skkIMrKrw64NPaZLdqxbfgN8fxv98XASgUy2qZDzVc3AA1y7&random=237176101&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:01 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 15 Jan 2024 23:17:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-01-15 23:17:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.5	50552	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2758	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:01 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c6afa3b6fc5500de&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQppYhDymuO7gYbH4t_4OmP9H6Q1wiEoESB x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A2TEI_GBk0NaOjH4dnv-aL0gjP_L4KBwyCaWd0qI-B5R2sxe0zAV1A==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.5	50550	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:00 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:00 GMT X-Cache: Error from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 4lJzh_3mTAi6J5ZhPjJqSfIy0OToWIccW5gUKMk769qEVBThjQidHQ==
2024-01-15 23:17:00 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.5	50551	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:01 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e033a3b63339021c&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsutX3cQkjYRcUAqetpLg-047ytI-WA96mc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: SpsuWK1jHSRSMhO4Fdp-B3m_VUs7qWMLlM2upo0lFTCal4nawy8NRw==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.5	50553	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:00 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:01 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:00 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ad5aa3b6e4c601ee&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZfFKYVUKd9EGBSfwYIuamij_d9J7n6HVg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: B0BFNKzvg56AD90YSqYF-Q046aNlHM5s4cwTbmnZfUdy-BhAiF_y-Q==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.5	50555	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:01 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:01 GMT X-Cache: Error from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: FxVWsT7rcxukn69yoiJ6geY268U1KvYwjxm6nxxXLosbR7ZRNRBDGQ==
2024-01-15 23:17:01 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.5	50556	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:01 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8e3da3b68b67022a&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsummRiBRtqHr6janRBSTVFJb2abIRfFMB4 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: z-g78F11LXajJAzuxAdCgne6ThZtG2jttBC-Vzyj0TmmEZ9M5eWXwQ==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.5	50558	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:01 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bb53a3b635af0360&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGem7VmSqKCd32AaTegVGQnGw3Ng6TlMZ6g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: MNmqobJor9C5CrDoOzIBQdJNZhy_HYivMHm8LmfBeer50wGIEfJVSQ==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.5	50557	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2758	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:01 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:01 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5eb2a3b6b778010c&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpTuHX3KOGzzPSc4av9hWdUBG6q8lWsU5D x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 8fc9659fc06389e49927f68638e9bc94.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: BAA-pp0x-_YU1JSJdHYClarXG4o5fIq4vpdAjgh4nhVjDWlT_ofArA==
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.5	50559	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 949 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:01 UTC	949	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 36 36 64 65 30 66 61 63 2d 66 37 31 34 2d 34 61 64 36 2d 39 33 66 63 2d 64 38 38 33 61 38 62 31 35 66 31 61 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"66de0fac-f714-4ad6-93fc-d883a8b15f1a","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:17:01 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:01 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.5	50560	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 3006 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:01 UTC	3006	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6d 6c 71 6a 6b 77 6f 44 41 41 41 41 3a 32 61 41 75 4b 6b 6a 2f 54 6b 4f 58 6d 4b 58 4b 50 55 6a 49 6b 43 53 5a 2f 68 4c 49 6b 4a 42 4c 4b 52 42 6b 68 73 39 58 6f 4b 4e 51 6c 37 72 78 4d 75 73 4d 4d 5a 45 2b 56 77 38 34 74 6b 78 53 4e 33 2f 76 2b 4c 48 58 77 55 36 42 37 71 2f 49 4c 50 71 4a 2b 66 4e 6a 69 47 47 39 6d 4c 35 54 42 45 4f 6e 35 65 76 72 37 77 33 54 49 49 51 59 32 57 78 78 41 68 65 4e 38 46 55 6f 59 53 6d 6e 56 74 48 65 69 37 30 4a 62 68 36 51 44 4a 6d 33 67 68 55 36 77 66 68 30 6d 43 6c 4a 79 4f 52 7a 68 42 34 65 76 69 69 79 7a 67 2f 48 78 52 59 73 73 73 65 34 66 52 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAmlqjkwoDAAAA:2aAuKkj/TkOXmKXKPUjIkCSZ/hLIkJBLKRBkhs9XoKNQl7rxMusMMZE+Vw84tkxSN3/v+LHXwU6B7q/ILPqJ+fNjiGG9mL5TBEOn5evr7w3TIIQY2WxxAheN8FUoYSmnVtHei70Jbh6QDJm3ghU6wfh0mClJyORzhB4eviiyzg/HxRYssse4fR
2024-01-15 23:17:01 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:17:01 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bced-53897283167deb3c23bdd003 X-Cache: Miss from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: OPQ2SnLSRmplWLsxwFo4mVAiekrdUD3r2nkMmSNnXdVMkmfKBUUUkA==
2024-01-15 23:17:01 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 76 56 47 69 41 67 30 71 41 41 41 41 3a 49 77 71 42 4f 45 76 7a 33 44 5a 33 75 34 67 4e 4a 68 4e 59 77 77 46 61 79 55 73 50 4c 42 36 78 55 6a 66 63 56 57 30 77 67 61 42 70 71 6f 4e 69 58 56 2f 61 51 57 68 43 59 6c 61 61 36 38 6d 4f 65 45 67 47 6f 67 53 38 4f 45 49 75 75 78 54 66 66 39 4b 53 71 58 5a 6d 65 45 72 52 57 70 48 73 43 72 38 34 2f 52 68 78 69 76 46 46 4a 69 6f 70 37 59 6a 77 49 44 75 55 51 76 53 63 59 76 4c 58 43 6d 37 61 41 5a 4a 44 57 59 67 36 6c 71 75 51 44 45 73 74 64 50 2f 34 54 67 56 46 79 43 36 41 36 42 71 47 79 48 4d 4c 36 71 72 56 79 6c 75 31 6b 2f 33 74 61 49 45 6b 78 6f 4d 55 73 37 46 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.5	50561	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 950 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:01 UTC	950	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 36 61 66 37 37 32 31 64 2d 33 37 63 66 2d 34 35 33 61 2d 38 36 62 38 2d 30 36 32 64 31 65 34 31 61 31 39 61 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"6af7721d-37cf-453a-86b8-062d1e41a19a","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:17:01 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:01 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.5	50562	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09APYnBZXVbwUfTkE1FvhfctoQkb_AB75ZHXpX52WiXk73rmTOX3G2-me0DdR-qAWYXsnn4sQFahK3c4tOImaZKqE; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-15 23:17:01 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Mon, 15 Jan 2024 23:17:01 GMT Expires: Mon, 15 Jan 2024 23:17:01 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-15 23:17:01 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-01-15 23:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.5	50563	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:01 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:01 GMT X-Cache: Error from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: yiMQn3jNC_Krl3Eu2ia8ICDMdy21XwJTKlt9jX2XXbEul3_9eePwWw==
2024-01-15 23:17:01 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.5	50564	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2579	OUT	GET /help.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&source=header&src=profile_contact_cs HTTP/1.1 Host: secure.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=1705360620485
2024-01-15 23:17:02 UTC	1214	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 357296 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT vary: Accept-Encoding cache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0 vary: Accept-Encoding, User-Agent nel: {"max_age":604800,"report_to":"default"} report-to: {"max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default"} set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwtU4iarpGKri8Cu9de16rTMmp4GFbPQpTDfcri4SVEhR5trIrkvNGBWVZHhLRjXkD2Swz2XAwHXwNWXgFsoTfpEotQ%2BVpT6E2SS5ppcL5GTQJVZV96mvnFhfA3TGwZL%2Bu9%2Bc%2Bh1V%2Biz%2Fow4rYv4BCYTexJ1EKDQHo%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:02 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 86f58a7ba760944d1efd0f2fe2242e1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: wSs8D0bBUbbeVntI-RCgtij-XgDu5BCtWVb_nUodKeNi43bFPvnVbw==
2024-01-15 23:17:02 UTC	15170	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 61 39 2e 63 6f 6d 2f 2d 2f 73 70 65 63 2f 6f 70 65 6e 73 65 61 72 63 68 2f 31 2e 31 2f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 Data Ascii: <!DOCTYPE html><html lang="en-us"><head profile="http://a9.com/-/spec/opensearch/1.1/"><meta name="referrer" content="origin"><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="referrer" content="origin"><meta name="rob
2024-01-15 23:17:02 UTC	10291	IN	Data Raw: 6f 72 74 5f 6e 61 6d 65 5f 6f 6e 6c 79 22 3a 22 44 65 63 22 2c 22 6f 6e 5f 64 61 79 5f 6d 6f 6e 74 68 22 3a 22 31 32 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 44 65 63 22 2c 22 6e 61 6d 65 5f 6f 6e 6c 79 22 3a 22 44 65 63 65 6d 62 65 72 22 2c 22 6e 61 6d 65 5f 74 6f 22 3a 22 44 65 63 65 6d 62 65 72 22 2c 22 67 65 6e 69 74 69 76 65 5f 75 63 22 3a 22 44 65 63 65 6d 62 65 72 22 2c 22 6e 61 6d 65 5f 6c 63 22 3a 22 44 65 63 65 6d 62 65 72 22 2c 22 6d 6f 6e 74 68 5f 31 22 3a 22 44 65 63 65 6d 62 65 72 22 7d 2c 22 32 22 3a 7b 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 75 63 22 3a 22 54 68 65 20 46 65 62 72 75 61 72 79 22 2c 22 6d 6f 6e 74 68 5f 32 22 3a 22 46 65 62 72 75 61 72 79 22 2c 22 6e 61 6d 65 5f 6f 74 68 65 72 22 3a 22 46 65 62 72 75 61 Data Ascii: ort_name_only":"Dec","on_day_month":"12","short_name":"Dec","name_only":"December","name_to":"December","genitive_uc":"December","name_lc":"December","month_1":"December"},"2":{"name_def_article_uc":"The February","month_2":"February","name_other":"Februa
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 68 65 6c 70 63 65 6e 74 65 72 26 73 6f 75 72 63 65 3d 68 65 61 64 65 72 26 27 2c 0a 62 5f 72 65 66 65 72 72 65 72 20 3a 20 27 27 2c 0a 62 5f 61 63 63 5f 74 79 70 65 20 3a 20 27 27 2c 0a 62 5f 72 65 71 5f 6c 6f 67 69 6e 3a 20 27 27 2c 0a 6a 73 74 20 3a 20 7b 27 6c 6f 61 64 69 6e 67 27 3a 20 74 72 75 65 7d 2c 0a 6b 65 65 70 5f 64 61 79 5f 6d 6f 6e 74 68 3a 20 74 72 75 65 2c 0a 62 5f 74 69 6d 65 73 74 61 6d 70 20 3a 20 31 37 30 35 33 36 30 36 32 32 2c 0a 72 65 66 65 72 61 6c 5f 74 61 62 3a 20 74 72 75 65 2c 0a 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 20 3a 20 7b 0a 7d 2c 0a 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 20 3a 20 31 2c 0a 62 5f 75 66 69 20 3a 20 27 27 2c 0a 22 73 65 74 76 61 72 5f 61 66 66 69 6c 69 61 74 65 5f 69 Data Ascii: helpcenter&source=header&',b_referrer : '',b_acc_type : '',b_req_login: '',jst : {'loading': true},keep_day_month: true,b_timestamp : 1705360622,referal_tab: true,scripts_tracking : {},enable_scripts_tracking : 1,b_ufi : '',"setvar_affiliate_i
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 66 62 65 37 35 39 32 31 30 64 34 65 61 33 65 61 35 38 32 63 62 27 3b 0a 70 61 72 61 6d 73 2e 61 69 64 20 3d 20 27 33 30 34 31 34 32 27 3b 0a 70 61 72 61 6d 73 2e 70 69 64 20 3d 20 27 36 38 38 30 61 33 62 36 64 37 36 64 30 30 63 35 27 3b 0a 70 61 72 61 6d 73 2e 73 74 79 70 65 20 3d 20 27 31 27 3b 0a 70 61 72 61 6d 73 2e 73 72 63 20 3d 20 27 68 65 6c 70 27 3b 0a 70 61 72 61 6d 73 2e 65 62 20 3d 20 27 30 27 3b 0a 70 61 72 61 6d 73 2e 65 5f 6f 62 6a 5f 6c 61 62 65 6c 73 20 3d 20 27 31 27 3b 0a 70 61 72 61 6d 73 2e 65 5f 74 63 6c 6d 20 3d 20 31 3b 0a 70 61 72 61 6d 73 2e 61 64 64 5f 74 68 65 6d 65 73 20 3d 20 27 31 27 3b 0a 70 61 72 61 6d 73 2e 74 68 65 6d 65 73 5f 6d 61 74 63 68 5f 73 74 61 72 74 20 3d 20 27 31 27 3b 0a 70 61 72 61 6d 73 2e 69 6e 63 6c 75 64 Data Ascii: fbe759210d4ea3ea582cb';params.aid = '304142';params.pid = '6880a3b6d76d00c5';params.stype = '1';params.src = 'help';params.eb = '0';params.e_obj_labels = '1';params.e_tclm = 1;params.add_themes = '1';params.themes_match_start = '1';params.includ
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 22 66 58 47 57 4d 51 63 43 56 4b 4c 4c 4e 65 4d 5a 65 45 4f 48 47 47 64 4f 41 47 52 4f 58 53 5a 46 4e 59 43 22 3a 31 2c 22 64 4c 63 58 4a 65 49 54 50 4d 4f 66 49 57 65 22 3a 31 2c 22 62 64 5a 53 41 63 63 54 58 59 61 57 48 46 58 65 64 46 49 61 51 59 61 43 22 3a 31 2c 22 61 64 55 41 56 59 43 64 46 4e 4c 47 5a 61 50 51 51 53 52 50 57 64 4f 51 52 54 4b 65 65 48 52 62 64 46 49 4b 65 22 3a 31 2c 22 48 4d 62 42 62 4f 55 4f 4f 4a 56 66 4a 46 59 4e 53 4f 50 4c 58 54 22 3a 32 2c 22 41 66 50 63 43 57 62 4b 4d 44 4e 64 45 48 58 64 52 54 22 3a 31 2c 22 63 43 48 4f 62 49 56 49 41 44 49 42 4e 47 53 64 4f 4e 62 43 4e 4c 4f 4c 4f 4c 4f 42 46 4f 22 3a 31 2c 22 61 58 62 53 62 63 42 55 59 57 59 48 61 52 4d 53 41 64 52 54 55 63 43 63 43 63 43 43 22 3a 31 2c 22 41 5a 4e 64 41 Data Ascii: "fXGWMQcCVKLLNeMZeEOHGGdOAGROXSZFNYC":1,"dLcXJeITPMOfIWe":1,"bdZSAccTXYaWHFXedFIaQYaC":1,"adUAVYCdFNLGZaPQQSRPWdOQRTKeeHRbdFIKe":1,"HMbBbOUOOJVfJFYNSOPLXT":2,"AfPcCWbKMDNdEHXdRT":1,"cCHObIVIADIBNGSdONbCNLOLOLOBFO":1,"aXbSbcBUYWYHaRMSAdRTUcCcCcCC":1,"AZNdA
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 31 2c 22 49 5a 62 52 45 5a 56 50 54 4c 4b 47 42 66 46 63 49 4e 47 4c 61 65 22 3a 31 2c 22 48 4d 62 56 61 63 44 4e 56 5a 4e 4d 50 48 56 44 5a 54 61 57 65 22 3a 31 2c 22 50 63 4a 44 44 4a 5a 47 4f 58 54 22 3a 31 2c 22 48 57 41 46 4e 63 4c 50 4c 57 49 54 4d 53 59 4e 4a 55 65 41 55 43 46 63 4e 63 4e 4b 65 22 3a 31 2c 22 61 58 54 66 4f 46 4a 5a 4d 59 65 4b 54 63 41 42 56 59 55 66 46 64 48 4d 50 56 57 43 47 54 51 4a 51 4a 45 54 22 3a 31 2c 22 65 44 53 64 55 66 62 66 4b 42 5a 54 53 4a 65 4f 58 62 62 46 46 62 4a 46 53 4d 5a 44 61 46 46 63 61 65 22 3a 31 2c 22 48 4d 65 43 4a 48 41 56 58 53 41 57 50 48 44 44 50 4e 53 52 44 41 4a 4c 54 22 3a 31 2c 22 4f 61 61 4b 51 5a 5a 4d 63 54 63 61 57 51 4f 63 5a 62 46 48 5a 52 54 59 43 22 3a 31 2c 22 42 43 64 47 4e 4a 59 47 62 Data Ascii: 1,"IZbREZVPTLKGBfFcINGLae":1,"HMbVacDNVZNMPHVDZTaWe":1,"PcJDDJZGOXT":1,"HWAFNcLPLWITMSYNJUeAUCFcNcNKe":1,"aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET":1,"eDSdUfbfKBZTSJeOXbbFFbJFSMZDaFFcae":1,"HMeCJHAVXSAWPHDDPNSRDAJLT":1,"OaaKQZZMcTcaWQOcZbFHZRTYC":1,"BCdGNJYGb
2024-01-15 23:17:02 UTC	15005	IN	Data Raw: 43 48 4f 62 45 43 56 56 44 44 4f 52 4d 54 66 46 62 52 5a 46 4a 47 4f 22 3a 31 2c 22 5a 63 53 49 63 63 65 4e 4a 56 47 47 5a 59 66 50 58 50 52 51 64 51 65 52 48 66 43 52 4f 22 3a 31 2c 22 61 61 41 4a 59 42 56 61 41 4a 44 62 41 50 51 66 51 4f 48 54 22 3a 31 2c 22 5a 64 5a 61 59 50 5a 5a 47 62 41 4b 58 56 47 44 50 66 51 65 46 54 63 5a 4a 4c 43 5a 42 4e 63 43 22 3a 31 2c 22 50 50 58 47 53 43 5a 46 43 46 63 43 5a 56 64 63 53 51 42 4b 51 4b 65 22 3a 31 2c 22 54 66 4e 5a 65 46 4f 42 59 63 41 51 59 49 66 42 63 54 66 4e 5a 42 51 55 53 52 65 22 3a 32 2c 22 59 54 42 65 57 66 43 44 45 61 4a 50 47 41 41 51 65 63 56 4b 66 42 4c 57 65 44 5a 51 4e 55 54 45 59 4d 4f 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 4a 65 61 49 4c 59 44 4d 46 46 55 4b 47 5a 49 55 4f 4e 53 46 54 55 51 Data Ascii: CHObECVVDDORMTfFbRZFJGO":1,"ZcSIcceNJVGGZYfPXPRQdQeRHfCRO":1,"aaAJYBVaAJDbAPQfQOHT":1,"ZdZaYPZZGbAKXVGDPfQeFTcZJLCZBNcC":1,"PPXGSCZFCFcCZVdcSQBKQKe":1,"TfNZeFOBYcAQYIfBcTfNZBQUSRe":2,"YTBeWfCDEaJPGAAQecVKfBLWeDZQNUTEYMO":1,"HWAFNeOYJeaILYDMFFUKGZIUONSFTUQ
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 22 3a 31 2c 22 65 45 42 5a 53 59 54 41 65 41 4c 46 65 50 4e 42 61 63 48 4f 64 4e 54 57 5a 48 54 22 3a 31 2c 22 4f 4d 54 56 42 45 4e 4e 46 5a 46 4a 46 52 4c 52 47 4f 22 3a 31 2c 22 55 45 54 54 4a 62 5a 57 4d 5a 66 50 41 4a 4f 42 47 44 49 63 45 62 43 47 48 66 55 4e 4c 4a 57 65 22 3a 31 2c 22 59 54 42 62 64 48 62 64 44 45 44 42 63 66 64 46 4f 4b 54 42 4e 48 43 22 3a 31 2c 22 66 65 62 64 53 41 59 46 63 61 46 55 59 4b 47 5a 65 56 41 42 4b 54 56 66 50 66 58 49 42 63 63 51 4e 46 53 64 64 55 5a 53 4e 64 4b 4e 4b 4e 4b 48 59 59 66 50 48 65 22 3a 31 2c 22 4f 4d 49 5a 45 57 45 53 64 4d 57 44 4f 46 52 4c 52 66 4f 4a 61 59 4f 22 3a 31 2c 22 65 45 42 5a 46 4a 5a 65 4f 51 50 50 48 46 42 64 64 51 53 4d 66 44 59 47 48 62 4f 55 43 22 3a 31 2c 22 59 57 59 48 66 55 44 65 41 Data Ascii: ":1,"eEBZSYTAeALFePNBacHOdNTWZHT":1,"OMTVBENNFZFJFRLRGO":1,"UETTJbZWMZfPAJOBGDIcEbCGHfUNLJWe":1,"YTBbdHbdDEDBcfdFOKTBNHC":1,"febdSAYFcaFUYKGZeVABKTVfPfXIBccQNFSddUZSNdKNKNKHYYfPHe":1,"OMIZEWESdMWDOFRLRfOJaYO":1,"eEBZFJZeOQPPHFBddQSMfDYGHbOUC":1,"YWYHfUDeA
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 2e 36 38 39 39 39 43 38 37 2e 33 37 34 37 20 36 2e 36 37 30 31 34 20 38 36 2e 34 38 35 31 20 36 2e 38 33 37 38 32 20 38 35 2e 36 35 38 34 20 37 2e 31 38 32 32 36 43 38 34 2e 38 33 31 38 20 37 2e 35 32 36 37 20 38 34 2e 30 38 36 33 20 38 2e 30 34 30 32 38 20 38 33 2e 34 37 20 38 2e 36 38 39 39 39 4c 38 33 2e 31 38 20 38 2e 39 37 39 39 39 4c 38 33 2e 30 38 20 38 2e 35 37 39 39 39 43 38 32 2e 39 32 36 31 20 38 2e 30 38 38 30 33 20 38 32 2e 36 30 32 31 20 37 2e 36 36 36 39 32 20 38 32 2e 31 36 36 20 37 2e 33 39 32 30 37 43 38 31 2e 37 32 39 39 20 37 2e 31 31 37 32 33 20 38 31 2e 32 31 30 32 20 37 2e 30 30 36 36 20 38 30 2e 37 20 37 2e 30 37 39 39 39 48 37 38 2e 35 37 56 32 33 2e 35 37 48 38 33 2e 32 39 56 31 35 2e 39 37 43 38 33 2e 32 37 35 20 31 35 2e 32 39 Data Ascii: .68999C87.3747 6.67014 86.4851 6.83782 85.6584 7.18226C84.8318 7.5267 84.0863 8.04028 83.47 8.68999L83.18 8.97999L83.08 8.57999C82.9261 8.08803 82.6021 7.66692 82.166 7.39207C81.7299 7.11723 81.2102 7.0066 80.7 7.07999H78.57V23.57H83.29V15.97C83.275 15.29
2024-01-15 23:17:02 UTC	16384	IN	Data Raw: 63 64 6c 3d 65 6e 2d 75 73 26 61 6d 70 3b 6c 61 6e 67 5f 63 68 61 6e 67 65 64 3d 31 22 0a 64 61 74 61 2d 6c 61 6e 67 3d 22 64 65 22 0a 68 72 65 66 6c 61 6e 67 3d 22 64 65 22 0a 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 69 6e 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 20 62 75 69 2d 69 6e 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 61 6c 69 67 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 69 6e 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 5f 5f 73 74 61 72 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 61 76 61 74 61 72 20 62 75 69 2d 61 76 61 74 61 72 2d 2d 73 6d 61 6c 6c 20 62 75 69 2d 74 72 61 76 65 6c 6c 65 72 2d 68 65 61 64 65 72 5f 5f 6c 61 6e 67 75 61 67 65 22 3e 0a 3c 69 6d 67 0a 63 6c 61 73 73 3d 22 62 75 69 Data Ascii: cdl=en-us&lang_changed=1"data-lang="de"hreflang="de"><div class="bui-inline-container bui-inline-container--align"><div class="bui-inline-container__start"><div class="bui-avatar bui-avatar--small bui-traveller-header__language"><imgclass="bui

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.5	50566	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:02 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1047a3b7d67d0233&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstuOwL6pXMsNllH0cxioc91v9xRrdOLHUM x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: TtBq75kJCifVinTwwP_5qK26N5mhpwKgvVHwKu5BRr3u_zKXOtZAsQ==
2024-01-15 23:17:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.5	50567	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2979	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=1705360618975
2024-01-15 23:17:02 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7610a3b7bbf60068&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZgDeCq5czTetLA_xIugfkCVAXXmE0677g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: -7sVY22X64aYauekmYiZscFg0Geh-iyOXRpC1ZxE4mxZxNqKNCU62A==
2024-01-15 23:17:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.5	50568	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:01 UTC	2758	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:02 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0a34a3b7111a0091&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp48fn91eh5TSza-0WUOMXMMc5z88Zuo9e x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: A7PHaEQnHyRxFccoZfXjm1E6tZf2HuPZEbqCsQNajTtYk9B5_9rYOA==
2024-01-15 23:17:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.5	50569	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:02 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:02 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:02 GMT X-Cache: Error from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 2ejEm69yvwdp0hDe56XVWKV6Heh5TZ842hspi1bMaUtZDnegK9tgww==
2024-01-15 23:17:02 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.5	50572	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:02 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:02 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3d76a3b771b80248&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGWxAW2dm6YlEsXXSlz89hLIisr5iYHFMSQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 71f1cca040033ebffc591cf9392d1528.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: n9BjC0b__Xuwy_rsGFfLLMbFZ2aVfKAmxgxFAOe8queDSeHfPFaBmg==
2024-01-15 23:17:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.5	50571	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:02 UTC	725	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1150 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:02 UTC	1150	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 31 30 62 66 36 36 61 62 2d 62 37 61 39 2d 34 64 61 36 2d 61 64 33 65 2d 64 66 33 32 30 32 31 39 38 64 61 61 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"10bf66ab-b7a9-4da6-ad3e-df3202198daa","ss":"1a065792-be81-49f6-b178-47e74a8775d1","bg":true,"s
2024-01-15 23:17:02 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:02 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.5	50573	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:02 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:02 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:02 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d78ba3b73dd9008f&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsteprJ2KeSAWAkmII5lgGXqng7O2N9-Xj8 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: BmRoD61sz2uMcZ7YTs9dQUIHrC3eYonoSNN6bX8J1uRPrIqED4c9Bw==
2024-01-15 23:17:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.5	50574	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:02 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:02 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:02 GMT X-Cache: Error from cloudfront Via: 1.1 6a615842cf9e2c637f2872ee9b70eb72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 32gJsoSr9bOlD9nBJAPQuFYOn7UiRKi8G-shTLNzkOBDj5ZdZtbvvA==
2024-01-15 23:17:02 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.5	50575	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:03 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=661ca3b77d8f00dc&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGflrCbFSAC1PxhqCEVoLRxYrc5MV9Al_JQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5eb5e19c1a78889d10ff38f1551ed2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: Gb7476feeRwNXlNiFkJHgYtjJ6WSvy78kRdImnOG-kbn-tJnSUeSpQ==
2024-01-15 23:17:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.5	50576	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; lastSeen=0; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK
2024-01-15 23:17:03 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1199a3b77536020c&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsv41HVxEzmwVRUib7YwbUUKHYbHYyJ8zLQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: sZVTZmQJ2D2dtys3TVBTgviFhGszOVbC2v544XWDMg9vL6F3z4uqlg==
2024-01-15 23:17:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.5	50577	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:03 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:03 GMT X-Cache: Error from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 3eGWm7eAhfMCgIn-Fv8sgx3aA5lWNJvZWtcoUCF-0Gfcs9IVgEJQ8Q==
2024-01-15 23:17:03 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.5	50578	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:03 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:03 GMT X-Cache: Error from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: s1ZekwQPHNZ5gRksOPdiv1s2Nd7TeGOdlacgnpxQpRad5Twme1Kw2A==
2024-01-15 23:17:03 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.5	50579	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:03 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=76eba3b7dc480024&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZgDeCq5czTen7xKuDXPhtkupzTuAMpuOw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 88b63cb2f8aab28c7291262ffc15282e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 6JgEWpJDwTC4AwAzUrY58B4HcHuIOo1fpLWDPeL0-oDLeVcdkNSUGw==
2024-01-15 23:17:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.5	50580	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	2774	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=1705360618975
2024-01-15 23:17:04 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=32eba3b76e0201af&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvQy-GfH2TYCvXEu1s45lK1iiLeLN0qlos x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: yQ9WpJhxOYL5W9xRu7dKlqIv2FOax_u-iXnmfEbptIBkWuRW3zj1Rw==
2024-01-15 23:17:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.5	50587	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	616	OUT	GET /static/css/logged_in_cloudfront_sd.iq_ltr/8c222a285cb8482a2fbef676ad2203a1091495c0.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	792	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 40737 Connection: close Server: nginx Date: Mon, 15 Jan 2024 18:02:47 GMT Last-Modified: Thu, 30 Nov 2023 15:16:45 GMT ETag: "6568a75d-9f21" Expires: Wed, 14 Feb 2024 18:02:47 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 90ad2a23a8617490c9d13e1f260633f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 5QGzwxQVnMHyZpjhp2SahkVshnEbV093GayewLp5WCAXTjN5zom98Q== Age: 18857
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 2e 67 65 73 70 72 69 74 65 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 67 65 6e 69 75 73 5f 69 63 6f 6e 73 2f 67 65 6e 69 75 73 5f 6d 6f 64 75 6c 65 2f 67 65 6e 69 75 73 2d 73 70 72 69 74 65 2d 76 33 2f 62 62 34 63 63 38 33 33 65 64 39 30 39 38 38 30 39 33 32 62 65 30 39 64 35 36 63 64 37 33 61 35 34 63 33 34 39 35 36 66 2e 70 6e 67 22 29 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 37 31 30 Data Ascii: .gesprite{display:inline-block;*display:inline;background-image:url("//cf.bstatic.com/static/img/genius_icons/genius_module/genius-sprite-v3/bb4cc833ed909880932be09d56cd73a54c34956f.png")!important;background-repeat:no-repeat!important;background-size:710
2024-01-15 23:17:04 UTC	2804	IN	Data Raw: 6c 65 78 2d 69 74 65 6d 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 7d 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 5f 5f 6e 65 77 2d 69 64 65 6e 74 69 74 79 20 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 2d 2d 62 6f 64 79 2d 2d 69 6d 61 67 65 2e 67 65 6e 69 75 73 5f 6c 65 76 65 6c 2d 31 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 7d 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 2d 2d 62 6f 64 79 2d 2d 61 76 61 74 61 72 7b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 77 69 64 74 68 3a 31 36 30 70 78 7d 2e 67 65 6e 69 75 73 2d Data Ascii: lex-item-align:start;align-self:flex-start}.genius-levels-status__new-identity .genius-levels-status--body--image.genius_level-1{padding-top:0}.genius-levels-status--body--avatar{height:auto;margin:0;overflow:visible;position:relative;width:160px}.genius-
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 2d 72 65 76 65 72 73 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 67 65 5f 62 70 5f 6e 6f 6e 5f 6c 6f 67 67 65 64 5f 75 73 65 72 20 2e 67 65 6e 69 75 73 2d 66 6f 6f 74 65 72 2d 73 69 67 6e 61 74 75 72 65 5f 5f 6c 6f 67 6f 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 34 70 78 7d 2e 67 65 5f 62 70 5f 6e 6f 6e 5f 6c 6f 67 67 65 64 5f 61 73 70 69 72 69 6e 67 20 2e 67 65 6e 69 75 73 2d 66 6f 6f 74 65 72 2d 73 69 67 6e 61 74 75 72 65 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 6d 61 72 67 69 6e 3a 38 70 78 20 2d 31 30 70 78 20 30 3b 70 61 64 64 69 6e 67 3a 38 70 78 20 38 70 78 20 30 20 38 70 78 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 62 70 5f 70 72 69 Data Ascii: -reverse;padding-bottom:0}.ge_bp_non_logged_user .genius-footer-signature__logo{margin-left:24px;margin-right:24px}.ge_bp_non_logged_aspiring .genius-footer-signature{border-top:1px solid #ebf3ff;margin:8px -10px 0;padding:8px 8px 0 8px;width:auto}.bp_pri
2024-01-15 23:17:04 UTC	5165	IN	Data Raw: 2d 72 6f 6f 6d 2d 73 65 6c 65 63 74 65 64 20 2e 72 74 5f 5f 67 65 2d 66 72 65 65 2d 62 72 65 61 6b 66 61 73 74 2d 6d 65 73 73 61 67 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 72 74 5f 5f 67 65 2d 66 72 65 65 2d 62 72 65 61 6b 66 61 73 74 2d 62 75 6c 6c 65 74 2d 70 6f 69 6e 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 2e 67 65 2d 66 72 65 65 2d 62 72 65 61 6b 66 61 73 74 2d 68 69 64 65 2d 62 72 65 61 6b 66 61 73 74 2d 69 6e 63 6c 75 64 65 64 20 2e 68 70 72 74 2d 72 65 73 65 72 76 61 74 69 6f 6e 2d 62 72 65 61 6b 66 61 73 74 2d 6d 65 73 73 61 67 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 70 72 74 2d 62 6f 6f 6b 69 6e 67 2d 73 75 6d 6d 61 72 79 2d 63 6f 6e 64 69 74 69 6f 6e 73 20 2e 72 74 5f 5f 67 Data Ascii: -room-selected .rt__ge-free-breakfast-message{display:none}.rt__ge-free-breakfast-bullet-point{font-weight:normal}.ge-free-breakfast-hide-breakfast-included .hprt-reservation-breakfast-message{display:none!important}.hprt-booking-summary-conditions .rt__g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.5	50589	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	627	OUT	GET /static/css/assistant_entrypoint_cloudfront_sd.iq_ltr/611b70b00745fa4412a0101292fb0a1e4c97741e.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	792	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 16321 Connection: close Server: nginx Date: Mon, 15 Jan 2024 13:44:31 GMT Last-Modified: Tue, 20 Dec 2022 12:37:07 GMT ETag: "63a1ac73-3fc1" Expires: Wed, 14 Feb 2024 13:44:31 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 65515d7b1028cd133489fb761d35fa06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: tOtraVn-Yh2pIbjP2mUQMEfx5JpbK8DIYn0QaCfCeZ0TPGDcxQBijQ== Age: 34353
2024-01-15 23:17:04 UTC	16321	IN	Data Raw: 2e 62 61 2d 74 61 62 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 61 66 63 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 30 70 78 20 32 35 70 78 7d 2e 62 61 2d 74 61 62 2d 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 62 61 2d 74 61 62 2d 2d 73 75 62 74 69 74 6c 65 7b 66 6f 6e Data Ascii: .ba-tab{background:#fafcff;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;min-height:200px;position:relative;padding:10px 10px 25px}.ba-tab--title{font-size:16px;font-weight:normal;padding:0;color:#333}.ba-tab--subtitle{fon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.5	50584	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	611	OUT	GET /static/css/pega_cloudfront_sd.iq_ltr/ac86554e5c372cd426f5393c7c95eea660624945.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	780	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5857 Connection: close Server: nginx Date: Mon, 15 Jan 2024 23:17:04 GMT Last-Modified: Fri, 26 Feb 2021 11:20:37 GMT ETag: "6038d985-16e1" Expires: Wed, 14 Feb 2024 23:17:04 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: yhhnceOp1wH9_ToqCr-NZuBB60Tv-CG6-gVArBPbcLaXjpa_bOLbCw==
2024-01-15 23:17:04 UTC	5857	IN	Data Raw: 23 4f 6e 6c 69 6e 65 48 65 6c 70 2c 23 53 65 72 76 69 63 65 43 61 73 65 47 61 64 67 65 74 2c 23 43 68 61 74 57 72 61 70 70 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 2d 39 30 30 70 78 3b 68 65 69 67 68 74 3a 35 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6d 61 72 67 69 6e 3a 2d 32 37 35 70 78 20 30 3b 77 69 64 74 68 3a 34 35 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 7a 2d 69 6e 64 65 78 3a 32 31 34 37 34 38 33 36 34 34 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 77 68 69 74 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 34 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 34 29 3b 62 Data Ascii: #OnlineHelp,#ServiceCaseGadget,#ChatWrapper{position:fixed;right:-900px;height:550px;top:50%;margin:-275px 0;width:450px;overflow:auto;z-index:2147483644;background:#fff;border:1px solid white;border-radius:4px;-webkit-box-shadow:0 0 14px rgba(0,0,0,.4);b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.5	50582	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	726	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1112 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:03 UTC	1112	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 32 37 34 35 65 30 65 39 2d 64 38 64 36 2d 34 39 33 62 2d 61 61 32 65 2d 66 33 34 63 63 63 35 32 64 33 33 31 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"2745e0e9-d8d6-493b-aa2e-f34ccc52d331","ss":"1a065792-be81-49f6-b178-47e74a8775d1","bg":true,"s
2024-01-15 23:17:04 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.5	50583	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	611	OUT	GET /static/css/help_cloudfront_sd.iq_ltr/cef6a9ab3ed133836378c47756fde5816a6a5448.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	768	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 366 Connection: close Server: nginx Date: Wed, 03 Jan 2024 13:18:42 GMT Last-Modified: Mon, 14 Nov 2022 03:58:31 GMT ETag: "6371bce7-16e" Expires: Fri, 02 Feb 2024 13:18:42 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: k85PMtgXrCVd9nOyPf82OKGd4dUGPKhfTAKvj2RvmB1r-R5UhZpfVQ== Age: 1072702
2024-01-15 23:17:04 UTC	366	IN	Data Raw: 62 6f 64 79 2e 68 65 6c 70 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 35 66 35 66 35 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 63 6f 6c 6f 72 28 23 30 30 37 31 63 32 20 61 28 30 2e 30 37 29 29 7d 62 6f 64 79 2e 68 63 2d 72 65 64 65 73 69 67 6e 2d 76 61 72 69 61 6e 74 2e 68 65 6c 70 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 29 7d 2e 68 65 6c 70 20 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 62 6f 64 79 2e 68 63 2d 72 65 64 65 73 69 67 6e 2d 76 61 72 69 61 6e 74 20 2e 68 Data Ascii: body.help{background-color:#f5f5f5;color:#333;-webkit-tap-highlight-color:color(#0071c2 a(0.07))}body.hc-redesign-variant.help{background-color:var(--bui_color_background_base)}.help #bodyconstraint{background-color:transparent}body.hc-redesign-variant .h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.5	50581	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:03 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:03 UTC	918	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 32 64 66 39 34 33 66 33 2d 65 66 33 63 2d 34 39 31 39 2d 62 66 61 35 2d 38 38 31 66 66 64 61 63 63 64 63 33 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"2df943f3-ef3c-4919-bfa5-881ffdaccdc3","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:17:04 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.5	50590	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:04 GMT X-Cache: Error from cloudfront Via: 1.1 e88b34dd0e6a8e6f16f12ba472ae0c12.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: _5aUJK1Bmt5ZyZvfTxX6f5iehLsPjhP82Fr8PxGHm2rRfGn4h2ke2Q==
2024-01-15 23:17:04 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.5	50588	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	570	OUT	GET /psb/capla/static/css/client.d20f8859.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	610	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 194024 Connection: close Date: Mon, 15 Jan 2024 23:17:05 GMT Last-Modified: Mon, 15 Jan 2024 14:48:14 GMT ETag: "1d8c553aeface7c02f954f9d5941504e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eT4rY.IfR.oKPWHhYHZKtyCEOvJImNd9 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Sco-b0W9jbdCPely_wcWKEGUjyy4fjkcEPrjh8txyNhTm9DEThD6aw== Vary: Origin
2024-01-15 23:17:04 UTC	1455	IN	Data Raw: 2e 66 63 64 39 65 65 63 38 66 62 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 66 63 64 39 65 65 63 38 66 62 20 73 76 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 5b 64 69 72 3d 72 74 6c 5d 20 2e 66 63 64 39 65 65 63 38 66 62 20 73 76 67 5b 64 61 74 61 2d 72 74 6c 2d 66 6c 69 70 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 7d 2e 66 65 32 35 35 64 38 35 34 31 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 63 32 35 33 36 31 63 33 37 66 7b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f Data Ascii: .fcd9eec8fb{display:inline-block;fill:currentcolor}.fcd9eec8fb svg{display:inline-block;vertical-align:top;height:100%;width:auto}[dir=rtl] .fcd9eec8fb svg[data-rtl-flip]{transform:scaleX(-1)}.fe255d8541{display:block}.c25361c37f{height:var(--bui_spacing_
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 62 34 32 35 63 32 39 63 33 37 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 35 29 7d 2e 64 66 32 62 37 63 63 34 62 61 7b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 63 62 37 38 37 36 39 34 35 64 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 37 29 7d 2e 65 32 35 32 61 38 39 65 63 36 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 39 29 7d 7d 2e 61 61 30 32 62 62 35 64 64 32 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 Data Ascii: ght:var(--bui_spacing_4x)}.b425c29c37{height:calc(var(--bui_spacing_1x)5)}.df2b7cc4ba{height:var(--bui_spacing_6x)}.cb7876945d{height:calc(var(--bui_spacing_1x)7)}.e252a89ec6{height:calc(var(--bui_spacing_1x)*9)}}.aa02bb5dd2{color:var(--bui_color_white)
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 30 29 7d 2e 63 32 61 63 63 63 39 38 37 30 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 33 30 30 29 7d 2e 64 66 39 37 39 63 65 32 61 32 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 63 38 32 34 33 35 61 34 62 38 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 5b 64 61 74 61 2d 62 75 69 Data Ascii: 0)}.c2accc9870{border-radius:var(--bui_border_radius_300)}.df979ce2a2{box-sizing:border-box;position:absolute;width:100%;height:100%;background-color:var(--bui_color_background_alt);padding:var(--bui_spacing_6x)}.c82435a4b8{box-sizing:border-box}[data-bui
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 2d 35 30 25 29 7d 2e 62 38 34 33 38 32 61 31 37 64 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 64 34 36 36 31 36 66 32 34 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 65 34 61 64 63 65 39 32 64 66 2c 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 65 65 64 62 61 39 65 38 38 61 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 61 34 63 31 38 30 35 38 38 37 5b 64 69 73 61 62 6c 65 64 5d 2c 2e 61 34 63 31 38 30 35 38 38 37 5b 64 69 73 61 62 6c 65 64 5d 3a 61 63 74 69 76 65 2c 2e 61 34 63 31 38 30 35 38 38 37 5b 64 69 73 61 62 6c 65 64 5d 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c Data Ascii: -50%)}.b84382a17d{cursor:default}.b84382a17d>.d46616f24d{display:block}.b84382a17d>.e4adce92df,.b84382a17d>.eedba9e88a{visibility:hidden}.a4c1805887[disabled],.a4c1805887[disabled]:active,.a4c1805887[disabled]:hover{color:var(--bui_color_foreground_disabl
2024-01-15 23:17:04 UTC	81	IN	Data Raw: 5f 73 65 63 6f 6e 64 61 72 79 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 61 36 61 33 38 33 37 30 30 63 7b 63 6f 6c 6f 72 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 63 35 62 32 33 33 32 38 35 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d Data Ascii: _secondary_foreground)}.a6a383700c{color:currentcolor}.c5b233285a{font-size:var(-
2024-01-15 23:17:04 UTC	2991	IN	Data Raw: 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 66 36 65 30 35 37 66 63 38 30 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 Data Ascii: -bui_font_display_1_font-size);font-weight:var(--bui_font_display_1_font-weight);line-height:var(--bui_font_display_1_line-height);font-family:var(--bui_font_display_1_font-family)}.f6e057fc80{font-size:var(--bui_font_display_2_font-size);font-weight:var(
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 61 62 66 30 39 33 62 64 66 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f Data Ascii: ont_body_2_font-weight);line-height:var(--bui_font_body_2_line-height);font-family:var(--bui_font_body_2_font-family)}.abf093bdfe{font-size:var(--bui_font_small_1_font-size);font-weight:var(--bui_font_small_1_font-weight);line-height:var(--bui_font_small_
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 Data Ascii: l,sans-serif;--bui_font_featured_1_font-size:20px;--bui_font_featured_1_font-weight:400;--bui_font_featured_1_line-height:28px;--bui_font_featured_1_font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_feature
2024-01-15 23:17:04 UTC	2048	IN	Data Raw: 69 63 6f 6e 5f 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 61 6c 65 72 74 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 61 6c 65 72 74 5f 62 6f 72 64 65 72 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 7d 2e 62 37 39 35 65 63 35 39 66 35 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 61 65 61 30 30 32 33 39 32 61 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 66 38 65 35 65 38 36 Data Ascii: icon_height:var(--bui_font_strong_1_line-height);background-color:var(--bui_alert_background);color:var(--bui_color_foreground);border:var(--bui_alert_border);padding:var(--bui_spacing_4x)}}.b795ec59f5{max-width:100%}.aea002392a{position:relative}.f8e5e86
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 31 30 30 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 Data Ascii: er:var(--bui_border_width_100) solid transparent;border-radius:var(--bui_border_radius_100);color:var(--bui_color_on_background);display:inline-flex;align-items:center;padding:calc(var(--bui_spacing_half) - var(--bui_border_width_100)) var(--bui_spacing_1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.5	50586	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	578	OUT	GET /psb/capla/static/css/4dfc553b.202caa61.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	609	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 26942 Connection: close Date: Mon, 15 Jan 2024 23:17:05 GMT Last-Modified: Mon, 15 Jan 2024 14:48:14 GMT ETag: "56be6f8ca27f57c0ae0f7dd1c1e6bac9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: RxRZw3vLekHJI.M6GAkTpBX5CoQEuKOC Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 65e185f36e65abff9322e261be3491d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: vrXUzNoT1J9Gl_r3FRIs-q1MNHtGEArZrBfCxTNx7MRi9ZT2Kz85yQ== Vary: Origin
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 37 35 70 78 29 7b 2e 64 63 35 31 38 31 38 36 63 38 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 64 63 35 31 38 31 38 36 63 38 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 7d 2e 64 63 35 31 38 31 38 36 63 38 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 7d 2e 63 33 66 33 61 63 39 36 33 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 Data Ascii: @media (max-width:575px){.dc518186c8{padding:var(--bui_spacing_4x)}}@media (min-width:576px){.dc518186c8{padding:var(--bui_spacing_6x)}}.dc518186c8{border:1px solid var(--bui_color_border_alt)}.c3f3ac963f{background-color:var(--bui_color_brand_primary_bac
2024-01-15 23:17:04 UTC	1025	IN	Data Raw: 6e 67 5f 31 78 29 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 65 64 35 37 31 36 34 37 64 33 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 36 37 33 32 63 30 65 35 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 64 30 66 35 66 61 36 35 65 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 6d 61 72 67 69 Data Ascii: ng_1x);margin-right:var(--bui_spacing_1x)}.ed571647d3{margin-left:var(--bui_spacing_2x);margin-right:var(--bui_spacing_2x)}.a6732c0e55{margin-left:var(--bui_spacing_3x);margin-right:var(--bui_spacing_3x)}.d0f5fa65e9{margin-left:var(--bui_spacing_4x);margi
2024-01-15 23:17:04 UTC	9533	IN	Data Raw: 63 69 6e 67 5f 31 32 78 29 7d 2e 61 31 38 39 30 64 65 64 36 31 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 36 78 29 7d 2e 65 32 64 30 36 38 36 33 65 61 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 34 78 29 7d 2e 64 34 39 35 64 37 35 34 33 32 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 7d 2e 66 38 33 30 38 65 39 65 64 33 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 66 39 65 33 34 34 61 63 35 35 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 66 32 62 63 30 30 61 64 33 30 7b 70 61 64 64 69 6e 67 Data Ascii: cing_12x)}.a1890ded61{padding:var(--bui_spacing_16x)}.e2d06863ea{padding:var(--bui_spacing_24x)}.d495d75432{padding-top:var(--bui_spacing_half)}.f8308e9ed3{padding-top:var(--bui_spacing_1x)}.f9e344ac55{padding-top:var(--bui_spacing_2x)}.f2bc00ad30{padding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.5	50585	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	621	OUT	GET /static/js/help_cloudfront_sd/1cc79a777d0ed9b6630492bb27146f0ce4e90d25.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	806	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 7359 Connection: close Server: nginx Date: Sat, 13 Jan 2024 04:30:59 GMT Last-Modified: Thu, 09 Nov 2023 02:43:40 GMT ETag: "654c475c-1cbf" Expires: Mon, 12 Feb 2024 04:30:59 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: qobT6FkHCeFWgK51ts0mnVxXZPAeCNYt07edbTNN-z9eoxyynDfgMw== Age: 240365
2024-01-15 23:17:04 UTC	7359	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 5f 69 5f 28 22 39 37 34 3a 63 62 36 61 35 34 37 61 22 29 2c 65 28 22 67 61 2d 74 72 61 63 6b 65 72 2d 62 61 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 5f 69 5f 28 22 39 37 34 3a 37 63 34 39 35 63 32 63 22 29 2c 72 2e 74 72 61 63 6b 54 69 6d 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 69 2c 6e 29 7b 69 66 28 5f 69 5f 28 22 39 37 34 3a 34 66 33 31 62 39 36 33 22 29 2c 21 77 69 6e 64 6f 77 2e 67 61 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 72 65 74 75 72 6e Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};!function(e,r){_i_("974:cb6a547a"),e("ga-tracker-base",function(e,r){_i_("974:7c495c2c"),r.trackTiming=function(e,r,i,n){if(_i_("974:4f31b963"),!window.ga)return _r_();if(void 0===e)return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.5	50592	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:04 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=32bea3b8c0490104&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfpSc184RvVY6qGqWzse7bs3fZXGqFNaKg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 417c242b19212928b079740e6dd8f54c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: eoYW8pbsSUKuqcvpF41A6XRuhFqFHdQ6AMIW9j6hrUUq1ORn0zedfA==
2024-01-15 23:17:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.5	50593	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	2762	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:04 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9d23a3b8b8b000ef&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu57eqFpDOLH_4hAqj34CX_sTqzjmEyt_8 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 ed8e6c4476f2632eef2c7ce856161af0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: ltgx4bVypZLY_q2R0njMiKTWZiBIpkiFzNqpCZpPiDG7PvrATjAF_A==
2024-01-15 23:17:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.5	50591	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	578	OUT	GET /psb/capla/static/css/7a53cdfb.d6ed6882.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	613	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 374 Connection: close Last-Modified: Fri, 12 Jan 2024 16:19:36 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: yjfPozjbH3msTCyzM9erlljaVkYH7V1G Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:17:05 GMT ETag: "9f40753f88d4e54c57bb481a34826a8c" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 1717f995f2ca7c5df4d0a972f90c1564.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cDMGPxDclyV0seuwfAI6yqUHqL45jS9BybbcckYmIEJ09TRgwY4FQA== Vary: Origin
2024-01-15 23:17:05 UTC	374	IN	Data Raw: 2e 66 63 32 66 32 63 30 64 61 38 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 64 38 34 30 35 34 31 62 61 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 61 65 39 35 33 36 62 65 35 64 7b 6d 61 78 2d 77 69 64 74 68 3a 39 31 38 70 78 7d 2e 66 35 32 32 61 38 64 34 34 62 7b 70 61 64 64 69 6e 67 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 29 7d 2e 64 63 36 32 35 34 34 34 65 66 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 Data Ascii: .fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.5	50594	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	655	OUT	GET /static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Tue, 26 Dec 2023 17:41:13 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Thu, 25 Jan 2024 17:41:13 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 4HaSt6O_139cGmjVg9gAL0YkSr0TXsLT0D1VcSEQftB-5G6BAfB3IQ== Age: 1748151
2024-01-15 23:17:04 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.5	50595	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:04 GMT X-Cache: Error from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: LvZSo2GHZJdrWPkGAAJc7AZsgrDSLOeiEIU18dNZURJPmN6MpPBMzg==
2024-01-15 23:17:04 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.5	50596	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:04 UTC	918	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 30 63 30 39 31 38 61 33 2d 30 35 37 35 2d 34 31 65 66 2d 39 62 36 63 2d 64 63 32 63 65 30 33 61 37 64 66 30 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"0c0918a3-0575-41ef-9b6c-dc2ce03a7df0","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:17:04 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.5	50597	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	725	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 952 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:04 UTC	952	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 63 32 64 34 39 64 33 62 2d 64 66 30 32 2d 34 33 61 33 2d 39 33 35 33 2d 31 34 66 66 65 35 61 36 63 62 36 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 66 66 38 30 37 61 65 36 2d 66 63 66 33 2d 34 63 31 63 2d 39 31 30 61 2d 61 33 63 63 64 32 31 30 30 63 30 33 22 2c 22 73 73 22 3a 22 30 35 64 65 39 62 33 34 2d 65 61 31 34 2d 34 65 64 35 2d 39 32 38 36 2d 61 64 37 61 61 39 35 61 63 35 31 37 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"c2d49d3b-df02-43a3-9353-14ffe5a6cb67","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"ff807ae6-fcf3-4c1c-910a-a3ccd2100c03","ss":"05de9b34-ea14-4ed5-9286-ad7aa95ac517","bg":true,"s
2024-01-15 23:17:05 UTC	429	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.5	50598	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	726	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1112 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:04 UTC	1112	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 66 63 38 61 38 30 64 63 2d 64 36 63 37 2d 34 34 63 65 2d 62 35 63 31 2d 64 64 66 34 32 35 63 32 33 31 33 37 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 65 66 63 35 35 35 30 64 2d 63 30 34 32 2d 34 33 66 64 2d 39 30 32 66 2d 30 37 38 35 37 36 39 30 38 33 63 34 22 2c 22 73 73 22 3a 22 31 61 30 36 35 37 39 32 2d 62 65 38 31 2d 34 39 66 36 2d 62 31 37 38 2d 34 37 65 37 34 61 38 37 37 35 64 31 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"fc8a80dc-d6c7-44ce-b5c1-ddf425c23137","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"efc5550d-c042-43fd-902f-0785769083c4","ss":"1a065792-be81-49f6-b178-47e74a8775d1","bg":true,"s
2024-01-15 23:17:05 UTC	388	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.5	50599	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	621	OUT	GET /static/js/pega_cloudfront_sd/2c9e180630f6e71e0eb0dcf243984b749e769642.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:04 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 242858 Connection: close Server: nginx Date: Sun, 07 Jan 2024 22:52:03 GMT Last-Modified: Mon, 26 Jul 2021 10:30:05 GMT ETag: "60fe8ead-3b4aa" Expires: Tue, 06 Feb 2024 22:52:03 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5893c71b6cde828b408a700f9c0673b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: G8XtciUDfZAfLBMUQB--KxnYw8VSMQEmdjKtpBfM252Lfk73wuN-OA== Age: 692701
2024-01-15 23:17:04 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 4d 61 73 68 75 70 4f 6e 4c 6f 61 64 28 29 7b 5f 69 5f 28 22 31 36 31 3a 35 33 33 65 31 35 39 62 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 4f 6e 6c 69 6e 65 48 65 6c 70 49 66 72 22 29 2e 68 65 69 67 68 74 3d 22 39 39 25 22 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 31 36 31 3a 32 31 64 37 32 30 32 39 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 4f 6e 6c 69 6e 65 48 65 6c 70 49 66 72 22 29 2e 68 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function handleMashupOnLoad(){_i_("161:533e159b"),document.querySelector("#OnlineHelpIfr").height="99%",setTimeout(function(){_i_("161:21d72029"),document.querySelector("#OnlineHelpIfr").h
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 61 72 6e 65 73 73 2d 69 64 22 29 26 26 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 61 72 6e 65 73 73 2d 69 64 22 29 3d 3d 3d 70 65 67 61 2e 63 74 78 2e 70 7a 48 61 72 6e 65 73 73 49 44 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 65 2e 74 61 72 67 65 74 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 6d 65 6e 75 2d 69 74 65 6d 2d 61 6e 63 68 6f 72 22 29 7c 7c 65 2e 74 61 72 67 65 74 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 29 29 7b 76 61 72 20 69 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 2e 6d 65 6e 75 2d 70 61 6e 65 6c 2d 77 72 61 70 70 65 72 22 Data Ascii: t.getAttribute("data-harness-id")&&t.getAttribute("data-harness-id")===pega.ctx.pzHarnessID)return _r_();if(e.target.classList.contains("menu-item-anchor")\|\|e.target.classList.contains("menu-item-title")){var i=document.querySelector(".menu-panel-wrapper"
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 72 70 69 63 6b 65 72 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 70 61 74 68 3a 22 63 6f 6c 6f 72 70 69 63 6b 65 72 2f 63 6f 6c 6f 72 70 69 63 6b 65 72 2d 6d 69 6e 2e 6a 73 22 2c 72 65 71 75 69 72 65 73 3a 5b 22 73 6c 69 64 65 72 22 2c 22 65 6c 65 6d 65 6e 74 22 5d 2c 6f 70 74 69 6f 6e 61 6c 3a 5b 22 61 6e 69 6d 61 74 69 6f 6e 22 5d 2c 73 6b 69 6e 6e 61 62 6c 65 3a 21 30 7d 2c 63 6f 6e 6e 65 63 74 69 6f 6e 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 70 61 74 68 3a 22 63 6f 6e 6e 65 63 74 69 6f 6e 2f 63 6f 6e 6e 65 63 74 69 6f 6e 2d 6d 69 6e 2e 6a 73 22 2c 72 65 71 75 69 72 65 73 3a 5b 22 65 76 65 6e 74 22 5d 7d 2c 63 6f 6e 74 61 69 6e 65 72 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 70 61 74 68 3a 22 63 6f 6e 74 61 69 6e 65 72 2f 63 6f 6e 74 61 69 6e 65 72 2d 6d 69 6e 2e 6a 73 Data Ascii: rpicker:{type:"js",path:"colorpicker/colorpicker-min.js",requires:["slider","element"],optional:["animation"],skinnable:!0},connection:{type:"js",path:"connection/connection-min.js",requires:["event"]},container:{type:"js",path:"container/container-min.js
2024-01-15 23:17:05 UTC	14808	IN	Data Raw: 6f 66 66 73 65 74 50 61 72 65 6e 74 7c 7c 22 6e 6f 6e 65 22 3d 3d 74 68 69 73 2e 67 65 74 53 74 79 6c 65 28 65 2c 22 64 69 73 70 6c 61 79 22 29 29 26 26 65 21 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 72 65 74 75 72 6e 20 5f 72 5f 28 21 31 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 74 28 65 29 29 7d 2c 6c 2e 44 6f 6d 2c 21 30 29 29 7d 2c 67 65 74 58 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 31 36 31 3a 39 32 35 38 64 62 30 36 22 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 6c 2e 44 6f 6d 2e 62 61 74 63 68 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 31 36 31 3a 61 61 30 30 38 32 33 65 22 29 2c 5f 72 5f 28 6c 2e 44 6f 6d 2e 67 65 74 58 59 28 65 29 5b 30 5d 29 7d 2c 6c 2e 44 6f 6d 2c 21 30 29 29 Data Ascii: offsetParent\|\|"none"==this.getStyle(e,"display"))&&e!=e.ownerDocument.body)return _r_(!1);return _r_(t(e))},l.Dom,!0))},getX:function(e){_i_("161:9258db06");return _r_(l.Dom.batch(e,function(e){return _i_("161:aa00823e"),_r_(l.Dom.getXY(e)[0])},l.Dom,!0))
2024-01-15 23:17:05 UTC	272	IN	Data Raw: 3a 5f 72 5f 28 76 5b 69 5d 29 7d 2c 75 73 65 4c 65 67 61 63 79 45 76 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 5f 69 5f 28 22 31 36 31 3a 32 64 65 38 66 61 64 33 22 29 2c 74 68 69 73 2e 77 65 62 6b 69 74 26 26 28 22 63 6c 69 63 6b 22 3d 3d 74 7c 7c 22 64 62 6c 63 6c 69 63 6b 22 3d 3d 74 29 29 7b 76 61 72 20 69 3d 70 61 72 73 65 49 6e 74 28 74 68 69 73 2e 77 65 62 6b 69 74 2c 31 30 29 3b 69 66 28 21 69 73 4e 61 4e 28 69 29 26 26 69 3c 34 31 38 29 72 65 74 75 72 6e 20 5f 72 5f 28 21 30 29 7d 72 65 74 75 72 6e 20 5f 72 5f 28 21 31 29 7d 2c 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 76 61 72 20 72 2c 61 2c 6e 3b 69 66 28 5f 69 5f 28 22 31 36 31 3a 33 63 32 37 33 31 30 39 22 29 2c 22 73 74 Data Ascii: :_r_(v[i])},useLegacyEvent:function(e,t){if(_i_("161:2de8fad3"),this.webkit&&("click"==t\|\|"dblclick"==t)){var i=parseInt(this.webkit,10);if(!isNaN(i)&&i<418)return _r_(!0)}return _r_(!1)},removeListener:function(e,t,i){var r,a,n;if(_i_("161:3c273109"),"st
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 3d 74 68 69 73 2e 67 65 74 45 6c 28 65 29 3b 65 6c 73 65 20 69 66 28 74 68 69 73 2e 5f 69 73 56 61 6c 69 64 43 6f 6c 6c 65 63 74 69 6f 6e 28 65 29 29 7b 76 61 72 20 6f 3d 21 30 3b 66 6f 72 28 72 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 2d 31 3c 72 3b 72 2d 2d 29 6f 3d 74 68 69 73 2e 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 28 65 5b 72 5d 2c 74 2c 69 29 26 26 6f 3b 72 65 74 75 72 6e 20 5f 72 5f 28 6f 29 7d 69 66 28 21 69 7c 7c 21 69 2e 63 61 6c 6c 29 72 65 74 75 72 6e 20 5f 72 5f 28 74 68 69 73 2e 70 75 72 67 65 45 6c 65 6d 65 6e 74 28 65 2c 21 31 2c 74 29 29 3b 69 66 28 22 75 6e 6c 6f 61 64 22 3d 3d 74 29 7b 66 6f 72 28 72 3d 66 2e 6c 65 6e 67 74 68 2d 31 3b 2d 31 3c 72 3b 72 2d 2d 29 69 66 28 28 6e 3d 66 5b 72 5d 29 26 26 6e 5b 30 5d 3d 3d 65 26 26 6e 5b 31 Data Ascii: =this.getEl(e);else if(this._isValidCollection(e)){var o=!0;for(r=e.length-1;-1<r;r--)o=this.removeListener(e[r],t,i)&&o;return _r_(o)}if(!i\|\|!i.call)return _r_(this.purgeElement(e,!1,t));if("unload"==t){for(r=f.length-1;-1<r;r--)if((n=f[r])&&n[0]==e&&n[1
2024-01-15 23:17:05 UTC	12398	IN	Data Raw: 63 65 70 74 69 6f 6e 20 64 65 74 65 63 74 65 64 2e 20 53 74 61 74 75 73 20 63 6f 64 65 20 69 73 20 22 2b 72 2c 22 77 61 72 6e 22 2c 22 43 6f 6e 6e 65 63 74 69 6f 6e 22 29 29 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 61 3d 74 68 69 73 2e 63 72 65 61 74 65 52 65 73 70 6f 6e 73 65 4f 62 6a 65 63 74 28 65 2c 6e 29 2c 74 26 26 74 2e 66 61 69 6c 75 72 65 26 26 28 74 2e 73 63 6f 70 65 3f 28 74 2e 66 61 69 6c 75 72 65 2e 61 70 70 6c 79 28 74 2e 73 63 6f 70 65 2c 5b 61 5d 29 2c 70 65 67 61 2e 6c 6f 67 28 22 46 61 69 6c 75 72 65 20 63 61 6c 6c 62 61 63 6b 20 77 69 74 68 20 73 63 6f 70 65 2e 20 48 54 54 50 20 73 74 61 74 75 73 20 63 6f 64 65 20 69 73 20 22 2b 72 2c 22 77 61 72 6e 22 2c 22 43 6f 6e 6e 65 63 74 69 6f 6e 22 29 29 3a 28 74 2e 66 61 69 6c 75 72 65 Data Ascii: ception detected. Status code is "+r,"warn","Connection")));break;default:a=this.createResponseObject(e,n),t&&t.failure&&(t.scope?(t.failure.apply(t.scope,[a]),pega.log("Failure callback with scope. HTTP status code is "+r,"warn","Connection")):(t.failure
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 73 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 31 36 31 3a 66 38 33 39 62 30 37 36 22 29 2c 6e 75 6c 6c 3d 3d 3d 72 26 26 28 72 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 74 68 69 73 2e 72 75 6e 2c 74 68 69 73 2e 64 65 6c 61 79 29 29 2c 5f 72 5f 28 29 7d 2c 74 68 69 73 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 5f 69 5f 28 22 31 36 31 3a 32 36 65 37 35 61 30 35 22 29 2c 65 29 74 68 69 73 2e 75 6e 52 65 67 69 73 74 65 72 28 65 29 3b 65 6c 73 65 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 72 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 69 3d 61 2e 6c 65 6e 67 74 68 3b 74 3c 69 3b 2b 2b 74 29 74 68 69 73 2e 75 6e 52 65 67 69 73 74 65 72 28 61 5b 30 5d 2c 30 29 3b 61 3d 5b 5d 2c 72 3d 6e 75 6c 6c 2c 6e 3d 30 7d 5f 72 5f 28 29 Data Ascii: start=function(){_i_("161:f839b076"),null===r&&(r=setInterval(this.run,this.delay)),_r_()},this.stop=function(e){if(_i_("161:26e75a05"),e)this.unRegister(e);else{clearInterval(r);for(var t=0,i=a.length;t<i;++t)this.unRegister(a[0],0);a=[],r=null,n=0}_r_()
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 29 3b 69 66 28 74 2e 6f 76 65 72 6c 61 70 3d 6e 75 6c 6c 2c 21 72 29 7b 76 61 72 20 6f 3d 6e 2e 67 65 74 54 61 72 67 65 74 43 6f 6f 72 64 28 65 2e 78 2c 65 2e 79 29 2c 73 3d 6e 2e 67 65 74 44 72 61 67 45 6c 28 29 3b 72 3d 6e 65 77 20 70 65 67 61 2e 75 74 69 6c 2e 52 65 67 69 6f 6e 28 6f 2e 79 2c 6f 2e 78 2b 73 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 6f 2e 79 2b 73 2e 6f 66 66 73 65 74 48 65 69 67 68 74 2c 6f 2e 78 29 7d 76 61 72 20 5f 3d 72 2e 69 6e 74 65 72 73 65 63 74 28 61 29 3b 72 65 74 75 72 6e 20 5f 3f 28 74 2e 6f 76 65 72 6c 61 70 3d 5f 2c 5f 72 5f 28 21 21 69 7c 7c 74 2e 63 75 72 73 6f 72 49 73 4f 76 65 72 29 29 3a 5f 72 5f 28 21 31 29 7d 2c 5f 6f 6e 55 6e 6c 6f 61 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 31 36 31 3a 39 33 30 Data Ascii: );if(t.overlap=null,!r){var o=n.getTargetCoord(e.x,e.y),s=n.getDragEl();r=new pega.util.Region(o.y,o.x+s.offsetWidth,o.y+s.offsetHeight,o.x)}var _=r.intersect(a);return _?(t.overlap=_,_r_(!!i\|\|t.cursorIsOver)):_r_(!1)},_onUnload:function(e,t){_i_("161:930
2024-01-15 23:17:05 UTC	3986	IN	Data Raw: 61 2e 65 78 74 65 6e 64 28 70 65 67 61 2e 75 74 69 6c 2e 44 44 54 61 72 67 65 74 2c 70 65 67 61 2e 75 74 69 6c 2e 44 72 61 67 44 72 6f 70 2c 7b 74 6f 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 31 36 31 3a 32 34 36 35 63 37 66 33 22 29 2c 5f 72 5f 28 22 44 44 54 61 72 67 65 74 20 22 2b 74 68 69 73 2e 69 64 29 7d 7d 29 2c 70 65 67 61 2e 72 65 67 69 73 74 65 72 28 22 64 72 61 67 64 72 6f 70 22 2c 70 65 67 61 2e 75 74 69 6c 2e 44 72 61 67 44 72 6f 70 4d 67 72 2c 7b 76 65 72 73 69 6f 6e 3a 22 32 2e 35 2e 32 22 2c 62 75 69 6c 64 3a 22 31 30 37 36 22 7d 29 2c 70 65 67 61 2e 75 74 69 6c 2e 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 31 36 31 3a 66 33 64 31 35 31 61 31 22 29 Data Ascii: a.extend(pega.util.DDTarget,pega.util.DragDrop,{toString:function(){return _i_("161:2465c7f3"),_r_("DDTarget "+this.id)}}),pega.register("dragdrop",pega.util.DragDropMgr,{version:"2.5.2",build:"1076"}),pega.util.Attribute=function(e,t){_i_("161:f3d151a1")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.5	50601	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	417	OUT	GET /static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Tue, 26 Dec 2023 17:41:13 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Thu, 25 Jan 2024 17:41:13 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: KVHGS8Drl7A8UoceUnAfKqM3uwSweSfCMiwfUuh0U9lL4Wzw2t6AoA== Age: 1748152
2024-01-15 23:17:05 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.5	50600	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:04 UTC	611	OUT	GET /consent/04f32d9e-1729-4d42-82b5-91c2350ff323/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:05 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d482e943392b-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 23156 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:05 GMT Last-Modified: Wed, 06 Sep 2023 13:29:35 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: jJw4nFI8a6xz0kQOZaj1PA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e95f6e4f-c01e-006d-0677-0c8dc8000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:05 UTC	467	IN	Data Raw: 31 35 35 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 1550!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-01-15 23:17:05 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 3d 3d 3d 68 7d 29 26 26 28 67 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 67 7d 28 61 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 63 2c 76 73 43 61 74 49 64 73 3a 62 7d 7d 66 75 6e 63 74 69 6f Data Ascii: =function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}functio
2024-01-15 23:17:05 UTC	1369	IN	Data Raw: 73 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 74 65 78 74 2f 70 6c 61 69 6e 22 3d 3d 3d 0a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 2e 72 65 6d 6f 76 Data Ascii: src\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexecute",c=function(e){"text/plain"===a.getAttribute("type")&&e.preventDefault();a.remov
2024-01-15 23:17:05 UTC	1369	IN	Data Raw: 6c 69 63 6b 2e 6e 65 74 20 65 76 65 72 65 73 74 74 65 63 68 2e 6e 65 74 20 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 67 6f 6f 67 6c 65 61 64 73 65 72 76 69 63 65 73 2e 63 6f 6d 20 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 20 6b 72 78 64 2e 6e 65 74 20 6c 69 61 64 6d 2e 63 6f 6d 20 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 20 6f 75 74 62 72 61 69 6e 2e 63 6f 6d 20 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 20 73 68 61 72 65 74 68 69 73 2e 63 6f 6d 20 74 61 62 6f 6f 6c 61 2e 63 6f 6d 20 74 77 69 74 74 65 72 2e 63 6f 6d 20 76 69 6d 65 6f 2e 63 6f 6d 20 79 61 68 6f 6f 2e 63 6f 6d 20 79 6f 75 74 75 62 65 2e 63 6f 6d 22 2e 73 70 6c 69 74 28 22 20 22 29 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f Data Ascii: lick.net everesttech.net facebook.com facebook.net googleadservices.com googlesyndication.com krxd.net liadm.com linkedin.com outbrain.com rubiconproject.com sharethis.com taboola.com twitter.com vimeo.com yahoo.com youtube.com".split(" ")).filter(functio
2024-01-15 23:17:05 UTC	890	IN	Data Raw: 7c 22 73 63 72 69 70 74 22 21 3d 3d 64 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 6e 28 6c 29 7c 7c 6d 28 68 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 68 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 6c 29 3f 28 64 3d 67 2c 68 3d 61 2c 21 28 6c 3d 6b 29 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 64 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 6e 28 68 29 7c 7c 6d 28 6c 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 6c 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 68 29 3f 63 28 22 73 72 63 22 2c 66 29 3a 28 61 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 29 2c 63 28 22 64 61 74 61 2d 73 72 63 22 2c 66 29 2c 28 67 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 Data Ascii: \|"script"!==d.toLowerCase()\|\|n(l)\|\|m(h.categoryIds,h.vsCatIds)\|\|p(l)?(d=g,h=a,!(l=k).categoryIds.length\|\|-1===t.indexOf(d.toLowerCase())\|\|n(h)\|\|m(l.categoryIds,l.vsCatIds)\|\|p(h)?c("src",f):(a.removeAttribute("src"),c("data-src",f),(g=a.getAttribute("class
2024-01-15 23:17:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.5	50603	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	2967	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEVSNL7X9OptRUva60yzR55rOnIedQsAwOhpaXvzzm7KR3QlOFMWyVmiuNwBOPlG2Vd70ihyjJExPMBgdH6Vsypw0LRljj6dH9Z8tFTijdoGjmnevoHgLNgDxM6170D6jUPS9BtjWOUvuiQObBkVIMjc%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAgA+i5x8gAAAA:8BjXYUZhVEPxinpSoEa86Xw4Zbaz8M8J0rkmojzX4UgcJAjbDi3nXqMIvBsaIQG6+DP7F5+a4Q21c2FkcO9RUK/tUvivJUuNnUHSd1S1dRno9TbKqe5WrpckNjmkkxY387ddmxmkslPjLk+gmsyYAF1qhEAHyX8DTpMihACAZrQ1ffkaaUjoJjKLaaDA+jurGxGpEAA+Jmz8S1DLcqFHeUVF5sN0qW/Uxb7k86u5oX2yU32mHAoEvPL4R4YL1sgllaCwVjJK; lastSeen=0
2024-01-15 23:17:05 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:05 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4db9a3b80f8301a1&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXQS-4eQFNzSgdtDIcUqer_qf2JUqKMynQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: UjvrVWjrUr2txh7QX2NG7ka9R646GglqyfIhd331U9JSmawexi3BvQ==
2024-01-15 23:17:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.5	50602	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:05 GMT X-Cache: Error from cloudfront Via: 1.1 e67eec39bafe7d4b59266632bc2a9886.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: lkpo3FxmFQNaznLyJWSdIiWneQEzFbHdAp3tSQ8db5n6IuK65u5zsA==
2024-01-15 23:17:05 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.5	50609	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	648	OUT	GET /static/img/nobg_all_blue_iq/b700d9e3067c1186a3364012df4fe1c48ae6da44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	745	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 73 Connection: close Server: nginx Date: Sat, 30 Dec 2023 21:58:35 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-49" Expires: Mon, 29 Jan 2024 21:58:35 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c57d1eb27f41d3e95fc5060845849c06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: XkpoVQvOgjZi8AqATigEUNhiU4xq9C0PoMOjBcuFEtLn3OLJk9PXLQ== Age: 1387110
2024-01-15 23:17:05 UTC	73	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 64 08 02 00 00 00 c8 4e cd 37 00 00 00 10 49 44 41 54 78 01 63 60 30 ad 1f 3c 78 14 03 00 c1 9e 46 51 38 13 50 b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRdN7IDATxc`0<xFQ8PIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.5	50607	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	633	OUT	GET /static/js/profile_menu_cst_cloudfront_sd/4f40f2dea8003cfc6a2c6dca6a110cdf2f68fc72.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 39991 Connection: close Server: nginx Date: Sat, 13 Jan 2024 14:53:42 GMT Last-Modified: Tue, 09 May 2023 09:44:05 GMT ETag: "645a15e5-9c37" Expires: Mon, 12 Feb 2024 14:53:42 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NAN3UFVYerQEHR38_aGb6Y0HHUSP5NsZGAl65X5MiQBbcVnqUU9ENg== Age: 203003
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 6a 73 74 6d 70 6c 28 22 70 72 6f 66 69 6c 65 5f 6d 65 6e 75 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 38 63 33 3a 65 37 64 61 33 36 62 64 22 29 3b 76 61 72 20 62 2c 64 3d 5b 22 5c 6e 20 20 20 20 22 2c 22 5c 6e 5c 6e 22 2c 27 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 75 63 2d 63 6f 6d 70 61 6e 79 2d 73 65 63 74 69 6f 6e 2d 32 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 75 63 2d 63 6f 6d 70 61 6e 79 2d 64 65 74 61 69 6c 73 2d 32 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 27 2c 22 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.jstmpl("profile_menu",function(){_i_("8c3:e7da36bd");var b,d=["\n ","\n\n",'\n <div class="uc-company-section-2">\n <div class="uc-company-details-2">\n ',"
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 3f 5f 2b 3d 5b 64 5b 31 30 30 5d 2c 73 2e 46 2e 68 74 6d 6c 28 73 2e 4d 43 28 66 5b 34 38 5d 29 29 2c 64 5b 31 30 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3a 5f 2b 3d 5b 64 5b 30 5d 2c 64 5b 31 38 5d 2b 73 2e 43 53 52 46 5f 54 4f 4b 45 4e 28 29 2b 64 5b 31 39 5d 2c 64 5b 35 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 5f 2b 3d 5b 64 5b 31 30 32 5d 2c 73 2e 46 2e 68 74 6d 6c 28 73 2e 4d 43 28 66 5b 34 39 5d 29 29 2c 64 5b 31 30 33 5d 2c 73 2e 46 2e 68 74 6d 6c 28 73 2e 4d 43 28 66 5b 35 30 5d 29 29 2c 64 5b 31 30 34 5d 2c 73 2e 46 2e 68 74 6d 6c 28 73 2e 4d 43 28 66 5b 35 31 5d 29 29 2c 64 5b 31 30 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 65 3d 5f 72 5f 28 5f 29 2c 65 2b 3d 5b 64 5b 31 30 35 5d 2c 73 2e 4d 45 28 64 5b 31 30 36 5d 2c 73 2e 4d 42 2c 73 2e 4d 4e 2c 6e 75 6c Data Ascii: ?_+=[d[100],s.F.html(s.MC(f[48])),d[101]].join(""):_+=[d[0],d[18]+s.CSRF_TOKEN()+d[19],d[5]].join(""),_+=[d[102],s.F.html(s.MC(f[49])),d[103],s.F.html(s.MC(f[50])),d[104],s.F.html(s.MC(f[51])),d[101]].join(""),e=_r_(_),e+=[d[105],s.ME(d[106],s.MB,s.MN,nul
2024-01-15 23:17:05 UTC	7223	IN	Data Raw: 2c 62 3d 73 2e 4d 45 28 64 5b 33 5d 2c 73 2e 4d 42 2c 73 2e 4d 4e 2c 6e 75 6c 6c 29 2c 61 2e 73 68 69 66 74 28 29 2c 62 29 2c 64 5b 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 5f 2b 3d 64 5b 35 5d 2c 65 3d 5f 72 5f 28 5f 29 2c 65 2b 3d 64 5b 35 5d 29 2c 65 3d 63 28 65 2b 3d 64 5b 35 5d 29 2c 65 2b 3d 5b 64 5b 36 5d 2c 73 2e 4d 43 28 66 5b 34 5d 29 3f 22 20 70 72 6f 66 69 6c 65 2d 6d 65 6e 75 2d 2d 6e 6f 2d 74 6f 70 2d 70 61 64 64 69 6e 67 22 3a 22 22 2c 64 5b 37 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 73 2e 4d 4a 28 73 2e 4d 43 28 66 5b 33 5d 29 2b 22 22 3d 3d 22 73 77 69 74 63 68 2d 61 63 63 6f 75 6e 74 73 22 29 26 26 28 65 2b 3d 64 5b 38 5d 29 2c 65 2b 3d 5b 64 5b 39 5d 2c 73 2e 4d 45 28 64 5b 31 30 5d 2c 73 2e 4d 42 2c 73 2e 4d 4e 2c 6e 75 6c 6c 29 2c 64 5b Data Ascii: ,b=s.ME(d[3],s.MB,s.MN,null),a.shift(),b),d[4]].join("")),_+=d[5],e=_r_(_),e+=d[5]),e=c(e+=d[5]),e+=[d[6],s.MC(f[4])?" profile-menu--no-top-padding":"",d[7]].join(""),s.MJ(s.MC(f[3])+""=="switch-accounts")&&(e+=d[8]),e+=[d[9],s.ME(d[10],s.MB,s.MN,null),d[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.5	50604	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	587	OUT	GET /psb/capla/static/js/client.16f4dc63.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	688	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1031205 Connection: close Date: Mon, 15 Jan 2024 14:58:58 GMT Last-Modified: Mon, 15 Jan 2024 14:34:40 GMT ETag: "92fecd2d77cc2e49867c2f067c4f3b23" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: XMoGeVpgkiF2VfNwMw4j165ftWEOgOKJ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: AbOhJ0R7FlQxqxZQLZjD2xQYx0NyXDqKubSvU5PeX1d7gA0zeQc47A== Age: 29888 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 31 36 66 34 64 63 36 33 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.16f4dc63.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 32 2d 35 2e 34 34 33 20 31 30 2e 32 35 31 2d 35 2e 33 38 36 7a 4d 31 35 20 31 32 61 33 20 33 20 30 20 31 20 31 2d 36 20 2e 30 30 34 20 33 20 33 20 30 20 30 20 31 20 36 2d 2e 30 30 37 56 31 32 7a 6d 31 2e 35 20 30 76 2d 2e 30 30 33 61 34 2e 35 20 34 2e 35 20 30 20 31 20 30 2d 39 2d 2e 30 30 32 20 34 2e 35 20 34 2e 35 20 30 20 30 20 30 20 39 20 2e 30 30 35 7a 22 7d 29 29 7d 7d 2c 61 62 65 31 63 31 32 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: 2-5.443 10.251-5.386zM15 12a3 3 0 1 1-6 .004 3 3 0 0 1 6-.007V12zm1.5 0v-.003a4.5 4.5 0 1 0-9-.002 4.5 4.5 0 0 0 9 .005z"}))}},abe1c127:function(e,t,n){"use strict";var r=n("ead71eb0");t.Z=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 64 61 79 22 2c 22 74 68 75 72 73 64 61 79 22 2c 22 66 72 69 64 61 79 22 2c 22 73 61 74 75 72 64 61 79 22 5d 2c 74 2e 4d 4f 4e 54 48 5f 4b 45 59 53 3d 5b 22 6a 61 6e 75 61 72 79 22 2c 22 66 65 62 72 75 61 72 79 22 2c 22 6d 61 72 63 68 22 2c 22 61 70 72 69 6c 22 2c 22 6d 61 79 22 2c 22 6a 75 6e 65 22 2c 22 6a 75 6c 79 22 2c 22 61 75 67 75 73 74 22 2c 22 73 65 70 74 65 6d 62 65 72 22 2c 22 6f 63 74 6f 62 65 72 22 2c 22 6e 6f 76 65 6d 62 65 72 22 2c 22 64 65 63 65 6d 62 65 72 22 5d 2c 74 2e 56 45 52 54 49 43 41 4c 5f 4d 4f 4e 54 48 53 5f 54 48 52 45 53 48 4f 4c 44 3d 32 2c 74 2e 56 45 52 54 49 43 41 4c 5f 4d 4f 4e 54 48 53 5f 53 48 4f 57 4e 3d 32 2a 74 2e 56 45 52 54 49 43 41 4c 5f 4d 4f 4e 54 48 53 5f 54 48 52 45 53 48 4f 4c 44 2b 31 7d 2c 62 33 35 65 35 31 Data Ascii: day","thursday","friday","saturday"],t.MONTH_KEYS=["january","february","march","april","may","june","july","august","september","october","november","december"],t.VERTICAL_MONTHS_THRESHOLD=2,t.VERTICAL_MONTHS_SHOWN=2*t.VERTICAL_MONTHS_THRESHOLD+1},b35e51
2024-01-15 23:17:06 UTC	15182	IN	Data Raw: 6e 64 65 6e 74 22 2c 22 70 61 64 64 69 6e 67 2d 6c 65 66 74 22 2c 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 22 2c 22 62 6f 78 2d 73 69 7a 69 6e 67 22 5d 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 69 3b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 32 29 2c 6e 7c 7c 28 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 74 65 78 74 61 72 65 61 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6e 29 29 3b 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 29 2c 6e 3d 4e 75 6d 62 65 72 2e 70 61 72 73 65 46 6c 6f 61 74 28 74 2e 67 65 74 50 72 6f 70 65 72 Data Ascii: ndent","padding-left","padding-right","box-sizing"];t.default=function(e,t,a){var i;void 0===t&&(t=2),n\|\|(n=document.createElement("textarea"),document.body.appendChild(n));var u=function(e){var t=window.getComputedStyle(e),n=Number.parseFloat(t.getProper
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 26 75 5b 22 72 6f 6f 74 2d 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 2d 22 2e 63 6f 6e 63 61 74 28 73 29 5d 2c 6c 26 26 75 5b 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 22 2e 63 6f 6e 63 61 74 28 6c 29 5d 2c 66 26 26 75 5b 22 72 6f 6f 74 2d 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 2d 22 2e 63 6f 6e 63 61 74 28 66 29 5d 2c 66 26 26 75 5b 22 72 6f 6f 74 2d 2d 62 6f 72 64 65 72 2d 77 69 64 74 68 2d 31 30 30 22 5d 2c 64 26 26 75 5b 22 72 6f 6f 74 2d 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 22 2e 63 6f 6e 63 61 74 28 64 29 5d 2c 70 26 26 75 5b 22 72 6f 6f 74 2d 2d 6f 76 65 72 66 6c 6f 77 2d 22 2e 63 6f 6e 63 61 74 28 70 29 5d 2c 6d 29 2c 79 3d 63 28 63 28 7b 7d 2c 28 30 2c 69 2e 72 65 73 70 6f 6e 73 69 76 65 53 74 79 6c 65 73 29 28 6e Data Ascii: &u["root--orientation-".concat(s)],l&&u["root--background-color-".concat(l)],f&&u["root--border-color-".concat(f)],f&&u["root--border-width-100"],d&&u["root--border-radius-".concat(d)],p&&u["root--overflow-".concat(p)],m),y=c(c({},(0,i.responsiveStyles)(n
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 64 65 66 61 75 6c 74 2c 73 28 7b 7d 2c 6c 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 75 2c 73 76 67 3a 72 7d 29 29 7d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 75 2e 5a 2c 7b 64 69 73 61 62 6c 65 64 3a 67 2c 68 72 65 66 3a 67 3f 76 6f 69 64 20 30 3a 66 2c 63 6c 61 73 73 4e 61 6d 65 3a 5f 2c 6f 6e 43 6c 69 63 6b 3a 76 2c 61 74 74 72 69 62 75 74 65 73 3a 6d 2c 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 3a 62 7d 2c 77 28 22 73 74 61 72 74 22 29 2c 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 74 65 78 74 7d 2c 74 7c 7c 6e 29 2c 77 28 22 65 6e 64 22 29 29 7d 7d 2c 22 39 33 34 62 39 37 63 64 22 Data Ascii: urn o().createElement(i.default,s({},l,{className:u,svg:r}))};return o().createElement(u.Z,{disabled:g,href:g?void 0:f,className:_,onClick:v,attributes:m,preventDefault:b},w("start"),o().createElement("span",{className:c.text},t\|\|n),w("end"))}},"934b97cd"
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 4f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 54 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 65 2e 61 63 74 69 76 65 3f 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 77 2c 4f 28 7b 7d 2c 65 29 29 3a 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6b 2c 4f 28 7b 7d 2c 65 29 29 7d 2c 4e 3d 6e 28 22 39 33 30 30 36 38 30 66 22 29 2c 78 3d 6e 28 22 36 33 61 62 37 30 65 33 22 29 2c 43 3d 6e 28 22 38 63 32 65 37 32 30 63 22 29 2c 49 3d 7b 72 6f 6f 74 3a 22 65 39 35 38 38 63 65 33 37 64 22 2c 63 6f 6e 74 61 69 6e 65 72 3a 22 64 32 37 34 34 37 62 38 34 65 22 2c 22 74 6f 70 2d 63 6f 6e 74 65 6e 74 22 3a 22 63 64 66 36 63 65 64 30 66 34 22 2c 22 74 6f 70 2d 63 6f 6e 74 65 6e 74 2d Data Ascii: O.apply(this,arguments)},T=function(e){return void 0!==e.active?a().createElement(w,O({},e)):a().createElement(k,O({},e))},N=n("9300680f"),x=n("63ab70e3"),C=n("8c2e720c"),I={root:"e9588ce37d",container:"d27447b84e","top-content":"cdf6ced0f4","top-content-
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 74 69 6f 6e 3a 22 72 6f 77 22 2c 67 61 70 3a 31 2c 63 6c 61 73 73 4e 61 6d 65 3a 4b 65 2e 6c 69 73 74 7d 2c 74 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 43 2e 64 65 66 61 75 6c 74 2e 49 74 65 6d 2c 7b 74 61 67 4e 61 6d 65 3a 22 6c 69 22 2c 6b 65 79 3a 65 2e 74 65 78 74 7d 2c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 4b 65 2e 69 74 65 6d 7d 2c 6e 3e 30 26 26 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6c 2e 64 65 66 61 75 6c 74 2c 7b 73 76 67 3a 51 65 2e 5a 2c 63 6c 61 73 73 4e 61 6d 65 3a 4b 65 2e 69 63 6f 6e 7d 29 2c 6e 3d 3d 3d 74 2e 6c 65 6e 67 74 68 2d 31 3f 61 28 29 2e 63 72 65 61 74 Data Ascii: tion:"row",gap:1,className:Ke.list},t.map((function(e,n){return a().createElement(C.default.Item,{tagName:"li",key:e.text},a().createElement("span",{className:Ke.item},n>0&&a().createElement(l.default,{svg:Qe.Z,className:Ke.icon}),n===t.length-1?a().creat
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 6e 74 3a 30 2c 65 6e 64 47 68 6f 73 74 73 43 6f 75 6e 74 3a 30 2c 69 64 3a 22 22 2c 69 74 65 6d 73 43 6f 75 6e 74 3a 30 2c 73 65 74 49 74 65 6d 73 43 6f 75 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 29 2c 6a 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 28 29 2e 75 73 65 43 6f 6e 74 65 78 74 28 4c 74 29 7d 2c 56 74 3d 4c 74 2c 7a 74 3d 6e 28 22 39 30 30 31 38 62 36 34 22 29 2c 42 74 3d 6e 28 22 37 35 31 61 33 38 37 35 22 29 2c 55 74 3d 7b 73 6d 61 6c 6c 3a 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 22 2e 63 6f 6e 63 61 74 28 7a 74 2e 64 65 66 61 75 6c 74 2e 4d 45 44 49 55 4d 2d 31 2c 22 70 78 29 22 29 2c 6d 65 64 69 75 6d 3a 22 28 6d 69 6e 2d 77 69 64 74 68 3a 20 22 2e 63 6f 6e 63 61 74 28 7a 74 2e 64 65 66 61 75 6c 74 2e 4d 45 44 49 55 Data Ascii: nt:0,endGhostsCount:0,id:"",itemsCount:0,setItemsCount:function(){}}),jt=function(){return a().useContext(Lt)},Vt=Lt,zt=n("90018b64"),Bt=n("751a3875"),Ut={small:"(max-width: ".concat(zt.default.MEDIUM-1,"px)"),medium:"(min-width: ".concat(zt.default.MEDIU
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 73 29 7d 2c 71 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3b 73 77 69 74 63 68 28 74 2e 74 79 70 65 29 7b 63 61 73 65 22 6d 6f 76 65 22 3a 72 65 74 75 72 6e 20 55 6e 28 55 6e 28 7b 7d 2c 65 29 2c 7b 73 74 79 6c 65 73 3a 55 6e 28 55 6e 28 55 6e 28 7b 7d 2c 44 6e 2e 44 45 46 41 55 4c 54 5f 53 54 59 4c 45 53 29 2c 7b 7a 49 6e 64 65 78 3a 65 2e 73 74 79 6c 65 73 2e 7a 49 6e 64 65 78 2c 74 6f 70 3a 74 2e 70 61 79 6c 6f 61 64 2e 79 7d 29 2c 74 2e 70 61 79 6c 6f 61 64 2e 69 73 52 54 4c 3f 7b 72 69 67 68 74 3a 22 63 61 6c 63 28 31 30 30 76 77 20 2d 20 22 2e 63 6f 6e 63 61 74 28 74 2e 70 61 79 6c 6f 61 64 2e 78 2d 31 32 2c 22 70 78 29 22 29 7d 3a 7b 6c 65 66 74 3a 74 2e 70 61 79 6c 6f 61 64 2e 78 7d 29 7d 29 3b 63 61 73 65 22 72 65 6e 64 65 72 Data Ascii: s)},qn=function(e,t){var n;switch(t.type){case"move":return Un(Un({},e),{styles:Un(Un(Un({},Dn.DEFAULT_STYLES),{zIndex:e.styles.zIndex,top:t.payload.y}),t.payload.isRTL?{right:"calc(100vw - ".concat(t.payload.x-12,"px)")}:{left:t.payload.x})});case"render

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.5	50605	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	595	OUT	GET /psb/capla/static/js/b25f03c4.223f6b5e.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:06 UTC	684	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 379 Connection: close Last-Modified: Fri, 12 Jan 2024 16:19:36 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: lCbKOH8SjV2FY.1BvLpkZ4xLU8K45DCB Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 05:16:38 GMT ETag: "4b78841a6a18bd217b7c158bb38d72c7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a21175361a1e842a337986b5f7399aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: pxbZ6Vq_uyMqxYUo70yQI6GqIT_k2lGAiKiFGEyChWfrUgNeRbLvjg== Age: 64829 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:17:06 UTC	379	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 62 32 35 66 30 33 63 34 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 5f 2c 62 29 7b 62 2e 72 28 5f 29 3b 76 61 72 20 63 3d 62 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 63 2e 73 65 72 76 65 29 28 28 28 29 3d 3e 62 2e 65 28 22 39 32 36 62 63 61 66 33 22 29 2e 74 68 65 6e 28 62 2e 62 69 6e 64 28 62 2c 22 36 34 62 37 37 38 Data Ascii: "use strict";(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b25f03c4"],{fe905f7b:function(e,_,b){b.r(_);var c=b("540adcd8");(0,c.serve)((()=>b.e("926bcaf3").then(b.bind(b,"64b778

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.5	50608	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	595	OUT	GET /psb/capla/static/js/926bcaf3.2af16116.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:06 UTC	675	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 24549 Connection: close Date: Mon, 15 Jan 2024 23:17:07 GMT Last-Modified: Mon, 15 Jan 2024 14:48:15 GMT ETag: "7a8679c882aedbee4307f162a1998bd5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: dNiDKxFke6dJAhrcL.0OQWg4wRv_Vulh Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 16f689172b396b7e266a396b6b5d6754.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: KuFRpafLILXD5ZnYK_4vvWUzUJKLcFODM7Fi7UUKfSNOjL5qgQxJ2w== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:17:06 UTC	8395	IN	Data Raw: 28 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 32 36 62 63 61 66 33 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 65 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 72 3d 74 28 22 36 65 65 38 38 63 35 34 22 29 2c 6f 3d 74 28 22 64 63 36 64 32 38 66 66 22 29 2c 69 3d 74 28 22 64 31 65 35 34 61 Data Ascii: (self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["926bcaf3"],{"181eacc8":function(n,e,t){"use strict";t.d(e,{d:function(){return a}});var r=t("6ee88c54"),o=t("dc6d28ff"),i=t("d1e54a
2024-01-15 23:17:06 UTC	8192	IN	Data Raw: 72 28 79 2c 52 29 2c 6f 26 26 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 67 2c 5f 29 29 3a 30 3d 3d 3d 71 26 26 28 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 79 2c 52 29 2c 6f 26 26 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 67 2c 5f 29 29 7d 76 61 72 20 49 3d 21 31 3b 76 61 72 20 4e 3d 7b 6c 65 6e 67 74 68 3a 65 2e 6c 65 6e 67 74 68 2c 61 63 74 69 6f 6e 3a 22 50 4f 50 22 2c 6c 6f 63 61 74 69 6f 6e 3a 55 2c 63 72 65 61 74 65 48 72 65 66 3a 4d 2c 70 75 73 68 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 76 61 72 20 6f 3d 22 50 55 53 48 22 2c 69 3d 70 28 6e 2c 72 2c 4f 28 29 2c 4e 2e 6c 6f 63 61 74 69 6f 6e 29 3b 43 2e 63 6f 6e 66 69 72 6d 54 72 61 6e 73 Data Ascii: r(y,R),o&&window.addEventListener(g,_)):0===q&&(window.removeEventListener(y,R),o&&window.removeEventListener(g,_))}var I=!1;var N={length:e.length,action:"POP",location:U,createHref:M,push:function(n,r){var o="PUSH",i=p(n,r,O(),N.location);C.confirmTrans
2024-01-15 23:17:06 UTC	7962	IN	Data Raw: 74 29 29 2c 65 29 7d 28 6e 2c 65 2c 74 29 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 72 65 74 75 72 6e 20 68 28 69 28 6e 2c 74 29 2c 65 2c 74 29 7d 28 6e 2c 65 2c 74 29 7d 7d 2c 22 38 66 66 35 65 38 62 36 22 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 28 22 62 38 66 66 38 64 33 64 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6f 2c 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 2c 65 2c 74 2c 6f 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 72 29 7b 76 61 72 20 63 3d 6e 65 77 20 45 72 72 6f 72 28 22 43 61 6c 6c 69 6e 67 20 50 72 6f Data Ascii: t)),e)}(n,e,t):function(n,e,t){return h(i(n,t),e,t)}(n,e,t)}},"8ff5e8b6":function(n,e,t){"use strict";var r=t("b8ff8d3d");function o(){}function i(){}i.resetWarningCache=o,n.exports=function(){function n(n,e,t,o,i,a){if(a!==r){var c=new Error("Calling Pro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.5	50606	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:05 UTC	595	OUT	GET /psb/capla/static/js/4dfc553b.0654ebd5.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:05 UTC	688	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1420626 Connection: close Date: Mon, 15 Jan 2024 14:58:58 GMT Last-Modified: Mon, 15 Jan 2024 14:48:15 GMT ETag: "3c3af787849f9feba7396d9edf6877e4" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: l4aBh5qKQouvqKpijPrMXsbOdWipqYsR Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: ApiZ3LfWAr6qrsOh3ZRg28CM_8gXDTrAb2QxLJD_Lg7CLf8BoVD8Og== Age: 29888 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:17:05 UTC	15696	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 64 66 63 35 35 33 62 2e 30 36 35 34 65 62 64 35 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 64 66 63 35 35 33 62 22 5d 2c 7b 22 33 34 64 35 63 31 30 66 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 Data Ascii: /! For license information please see 4dfc553b.0654ebd5.chunk.js.LICENSE.txt /(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4dfc553b"],{"34d5c10f":function(e,t,o){"use strict
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 65 7d 2c 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 61 28 7b 76 69 65 77 42 6f 78 3a 22 30 20 30 20 31 32 38 20 31 32 38 22 2c 77 69 64 74 68 3a 22 31 65 6d 22 2c 68 65 69 67 68 74 3a 22 31 65 6d 22 7d 2c 65 29 2c 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 38 38 20 31 31 36 61 34 20 34 20 30 20 30 20 31 2d 34 20 34 48 34 34 61 34 20 34 20 30 20 30 20 31 20 30 2d 38 68 34 30 61 34 20 34 20 30 20 30 20 31 20 34 20 34 7a 6d 33 32 2d 35 36 63 30 20 32 38 2d 32 30 2e 34 20 34 34 2d 35 36 20 34 34 53 38 20 Data Ascii: e},a.apply(this,arguments)}var i=function(e){return r.default.createElement("svg",a({viewBox:"0 0 128 128",width:"1em",height:"1em"},e),r.default.createElement("path",{d:"M88 116a4 4 0 0 1-4 4H44a4 4 0 0 1 0-8h40a4 4 0 0 1 4 4zm32-56c0 28-20.4 44-56 44S8
2024-01-15 23:17:05 UTC	16384	IN	Data Raw: 5b 74 5d 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6e 29 26 26 28 65 5b 6e 5d 3d 6f 5b 6e 5d 29 7d 72 65 74 75 72 6e 20 65 7d 2c 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 61 28 7b 76 69 65 77 42 6f 78 3a 22 30 20 30 20 31 32 38 20 31 32 38 22 2c 77 69 64 74 68 3a 22 31 65 6d 22 2c 68 65 69 67 68 74 3a 22 31 65 6d 22 7d 2c 65 29 2c 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 33 35 Data Ascii: [t];for(var n in o)Object.prototype.hasOwnProperty.call(o,n)&&(e[n]=o[n])}return e},a.apply(this,arguments)}var i=function(e){return r.default.createElement("svg",a({viewBox:"0 0 128 128",width:"1em",height:"1em"},e),r.default.createElement("path",{d:"M35
2024-01-15 23:17:06 UTC	15496	IN	Data Raw: 2e 5a 3d 76 6f 69 64 20 30 3b 76 61 72 20 6e 2c 72 3d 28 6e 3d 6f 28 22 65 61 64 37 31 65 62 30 22 29 29 26 26 6e 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 6e 3a 7b 64 65 66 61 75 6c 74 3a 6e 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 72 65 74 75 72 6e 20 61 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 31 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6e 29 26 26 28 65 5b 6e 5d 3d 6f 5b 6e 5d 29 7d 72 65 74 75 72 6e 20 65 7d 2c 61 2e 61 70 70 6c 79 Data Ascii: .Z=void 0;var n,r=(n=o("ead71eb0"))&&n.__esModule?n:{default:n};function a(){return a=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var o=arguments[t];for(var n in o)Object.prototype.hasOwnProperty.call(o,n)&&(e[n]=o[n])}return e},a.apply
2024-01-15 23:17:06 UTC	366	IN	Data Raw: 20 31 32 38 20 31 32 38 22 2c 77 69 64 74 68 3a 22 31 65 6d 22 2c 68 65 69 67 68 74 3a 22 31 65 6d 22 7d 2c 65 29 2c 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 39 2e 32 20 31 34 2e 38 61 34 20 34 20 30 20 30 20 31 20 35 2e 36 2d 35 2e 36 6c 33 34 20 33 34 61 34 20 34 20 30 20 31 20 31 2d 35 2e 36 20 35 2e 36 7a 6d 31 37 2e 36 20 33 36 61 34 20 34 20 30 20 30 20 30 20 30 2d 35 2e 36 6c 2d 31 32 2d 31 32 61 34 20 34 20 30 20 31 20 30 2d 35 2e 36 20 35 2e 36 6c 31 32 20 31 32 61 34 20 34 20 30 20 30 20 30 20 35 2e 36 20 30 7a 6d 31 38 2e 34 2d 32 34 61 34 20 34 20 30 20 30 20 30 20 35 2e 36 2d 35 2e 36 6c 2d 31 32 2d 31 32 61 34 20 34 20 30 20 30 20 30 2d 35 2e 36 20 35 2e 36 7a 4d 37 32 20 36 Data Ascii: 128 128",width:"1em",height:"1em"},e),r.default.createElement("path",{d:"M9.2 14.8a4 4 0 0 1 5.6-5.6l34 34a4 4 0 1 1-5.6 5.6zm17.6 36a4 4 0 0 0 0-5.6l-12-12a4 4 0 1 0-5.6 5.6l12 12a4 4 0 0 0 5.6 0zm18.4-24a4 4 0 0 0 5.6-5.6l-12-12a4 4 0 0 0-5.6 5.6zM72 6
2024-01-15 23:17:06 UTC	12792	IN	Data Raw: 20 30 20 30 20 34 36 2e 36 20 37 32 48 36 34 7a 6d 32 34 20 32 34 41 31 36 20 31 36 20 30 20 30 20 30 20 36 35 2e 34 20 38 30 48 34 38 6c 31 31 2e 33 20 31 31 2e 33 41 31 36 20 31 36 20 30 20 30 20 30 20 37 30 2e 36 20 39 36 48 38 38 7a 4d 38 39 2e 34 20 31 30 34 48 37 32 6c 31 31 2e 33 20 31 31 2e 33 61 31 36 20 31 36 20 30 20 30 20 30 20 31 31 2e 33 20 34 2e 37 48 31 31 32 6c 2d 31 31 2e 33 2d 31 31 2e 33 61 31 36 20 31 36 20 30 20 30 20 30 2d 31 31 2e 33 2d 34 2e 37 7a 4d 39 36 20 38 38 56 37 30 2e 36 61 31 36 20 31 36 20 30 20 30 20 30 2d 34 2e 37 2d 31 31 2e 33 4c 38 30 20 34 38 76 31 37 2e 34 61 31 36 20 31 36 20 30 20 30 20 30 20 34 2e 37 20 31 31 2e 33 7a 6d 31 39 2e 33 2d 34 2e 37 4c 31 30 34 20 37 32 76 31 37 2e 34 61 31 36 20 31 36 20 30 20 30 Data Ascii: 0 0 46.6 72H64zm24 24A16 16 0 0 0 65.4 80H48l11.3 11.3A16 16 0 0 0 70.6 96H88zM89.4 104H72l11.3 11.3a16 16 0 0 0 11.3 4.7H112l-11.3-11.3a16 16 0 0 0-11.3-4.7zM96 88V70.6a16 16 0 0 0-4.7-11.3L80 48v17.4a16 16 0 0 0 4.7 11.3zm19.3-4.7L104 72v17.4a16 16 0 0
2024-01-15 23:17:06 UTC	12792	IN	Data Raw: 20 34 20 30 20 30 20 31 20 30 20 2e 35 76 2e 37 61 34 20 34 20 30 20 30 20 31 20 30 20 2e 34 76 2e 37 61 34 20 34 20 30 20 30 20 31 2d 2e 31 2e 34 6c 2d 2e 32 2e 33 61 34 20 34 20 30 20 30 20 31 2d 2e 32 2e 34 6c 2d 2e 32 2e 32 61 34 20 34 20 30 20 30 20 31 2d 2e 33 2e 33 6c 2d 2e 32 2e 32 61 34 20 34 20 30 20 30 20 31 2d 2e 35 2e 34 68 2d 2e 31 61 34 20 34 20 30 20 30 20 31 2d 2e 37 2e 34 68 2d 2e 33 6c 2d 2e 33 2e 31 61 34 20 34 20 30 20 30 20 31 2d 2e 36 20 30 68 2d 2e 31 61 34 20 34 20 30 20 30 20 31 2d 2e 37 20 30 4c 33 32 2e 35 20 35 37 61 32 37 2e 38 20 32 37 2e 38 20 30 20 30 20 30 2d 2e 35 20 35 20 34 20 34 20 30 20 30 20 31 2d 35 2e 36 20 33 2e 37 6c 2d 31 36 2d 37 2e 31 41 34 20 34 20 30 20 30 20 31 20 38 20 35 35 7a 6d 32 37 2d 35 2e 37 6c 32 Data Ascii: 4 0 0 1 0 .5v.7a4 4 0 0 1 0 .4v.7a4 4 0 0 1-.1.4l-.2.3a4 4 0 0 1-.2.4l-.2.2a4 4 0 0 1-.3.3l-.2.2a4 4 0 0 1-.5.4h-.1a4 4 0 0 1-.7.4h-.3l-.3.1a4 4 0 0 1-.6 0h-.1a4 4 0 0 1-.7 0L32.5 57a27.8 27.8 0 0 0-.5 5 4 4 0 0 1-5.6 3.7l-16-7.1A4 4 0 0 1 8 55zm27-5.7l2
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6e 29 26 26 28 65 5b 6e 5d 3d 6f 5b 6e 5d 29 7d 72 65 74 75 72 6e 20 65 7d 2c 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 61 28 7b 76 69 65 77 42 6f 78 3a 22 30 20 30 20 31 32 38 20 31 32 38 22 2c 77 69 64 74 68 3a 22 31 65 6d 22 2c 68 65 69 67 68 74 3a 22 31 65 6d 22 7d 2c 65 29 2c 72 2e 64 Data Ascii: guments.length;t++){var o=arguments[t];for(var n in o)Object.prototype.hasOwnProperty.call(o,n)&&(e[n]=o[n])}return e},a.apply(this,arguments)}var i=function(e){return r.default.createElement("svg",a({viewBox:"0 0 128 128",width:"1em",height:"1em"},e),r.d
2024-01-15 23:17:06 UTC	2804	IN	Data Raw: 75 6c 65 3f 6e 3a 7b 64 65 66 61 75 6c 74 3a 6e 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 72 65 74 75 72 6e 20 61 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 31 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 6e 29 26 26 28 65 5b 6e 5d 3d 6f 5b 6e 5d 29 7d 72 65 74 75 72 6e 20 65 7d 2c 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 2e 64 65 Data Ascii: ule?n:{default:n};function a(){return a=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var o=arguments[t];for(var n in o)Object.prototype.hasOwnProperty.call(o,n)&&(e[n]=o[n])}return e},a.apply(this,arguments)}var i=function(e){return r.de
2024-01-15 23:17:06 UTC	12792	IN	Data Raw: 30 2d 2e 32 20 38 41 32 37 20 32 37 20 30 20 30 20 31 20 31 31 32 20 35 30 2e 31 61 34 20 34 20 30 20 30 20 30 20 34 20 33 2e 39 68 2e 31 61 34 20 34 20 30 20 30 20 30 20 33 2e 39 2d 34 2e 31 41 33 35 20 33 35 20 30 20 30 20 30 20 38 36 2e 31 20 31 36 7a 22 7d 29 2c 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 38 35 2e 31 20 33 31 48 38 35 61 34 20 34 20 30 20 30 20 30 2d 2e 31 20 38 41 31 31 2e 35 20 31 31 2e 35 20 30 20 30 20 31 20 39 36 20 35 30 2e 31 61 34 20 34 20 30 20 30 20 30 20 34 20 33 2e 39 68 2e 31 61 34 20 34 20 30 20 30 20 30 20 33 2e 39 2d 34 2e 31 41 31 39 2e 35 20 31 39 2e 35 20 30 20 30 20 30 20 38 35 2e 31 20 33 31 7a 4d 34 34 2e 34 20 37 32 2e 35 43 33 37 2e 31 20 37 34 20 Data Ascii: 0-.2 8A27 27 0 0 1 112 50.1a4 4 0 0 0 4 3.9h.1a4 4 0 0 0 3.9-4.1A35 35 0 0 0 86.1 16z"}),r.default.createElement("path",{d:"M85.1 31H85a4 4 0 0 0-.1 8A11.5 11.5 0 0 1 96 50.1a4 4 0 0 0 4 3.9h.1a4 4 0 0 0 3.9-4.1A19.5 19.5 0 0 0 85.1 31zM44.4 72.5C37.1 74

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.5	50610	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	3132	OUT	GET /cookiebanner.html HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360621686; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwtU4iarpGKri8Cu9de16rTMmp4GFbPQpTDfcri4SVEhR5trIrkvNGBWVZHhLRjXkD2Swz2XAwHXwNWXgFsoTfpEotQ%2BVpT6E2SS5ppcL5GTQJVZV96mvnFhfA3TGwZL%2Bu9%2Bc%2Bh1V%2Biz%2Fow4rYv4BCYTexJ1EKDQHo%3D; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ
2024-01-15 23:17:06 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 2407 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:06 GMT vary: User-Agent, Accept-Encoding nel: {"max_age":604800,"report_to":"default"} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default","max_age":604800} set-cookie: _implmdnbl=2__1__0; path=/; expires=Wed, 16-Jan-2019 23:17:06 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Wed, 30-Mar-2078 22:34:12 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCrRQJj4Vk7QFBPqoohKR3G%2BAO9fScOM6mPrwxLIbtoRfTlH265Wuzl9nyr46PnlTFujNG12Vk%2FBF%2BPZp0Reet%2FjYllO9WYFzdT1J%2BoU32%2F8iXGM9q0y3Lhc%2Fpxr76nmSu%2B2We7B0kmReR%2FbQ3f1ecB9rp4%2FpBtmnQQ%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:06 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: MvhYY0QvWpMimntuWWE3K0dGqjwwu0y7ICwl648Ktkqq3n-DVb0XxQ==
2024-01-15 23:17:06 UTC	2407	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 4f 54 5f 43 4f 4e 53 45 4e 54 5f 43 4f 4f 4b 49 45 20 3d 20 27 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 27 3b 0a 76 61 72 20 4f 54 5f 41 4c 45 52 54 5f 43 4c 4f 53 45 44 5f 43 4f 4f 4b 49 45 20 3d 20 27 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 27 3b 0a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 20 72 65 63 65 69 76 65 4d 65 73 73 61 67 65 2c 20 66 61 6c 73 65 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 72 65 63 65 69 76 65 4d 65 73 73 61 67 65 28 65 76 65 6e 74 29 20 7b 0a 69 66 20 28 65 76 65 6e 74 20 26 26 20 65 76 65 6e 74 Data Ascii: <!DOCTYPE html><html lang="en"><head><script>var OT_CONSENT_COOKIE = 'OptanonConsent';var OT_ALERT_CLOSED_COOKIE = 'OptanonAlertBoxClosed';window.addEventListener("message", receiveMessage, false);function receiveMessage(event) {if (event && event

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.5	50611	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	595	OUT	GET /psb/capla/static/js/7a53cdfb.692b69e3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://secure.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:06 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 43564 Connection: close Date: Mon, 15 Jan 2024 14:58:58 GMT Last-Modified: Mon, 15 Jan 2024 14:48:15 GMT ETag: "a49fef705480f68e235a3ddee061e361" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: rkyCcIsAbpUMPfw18lJ_nJWgGtLuHCia Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 67711c5cba0352ee130f60f6cc103e0a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: NnnUlLVRIwhkLgOKYdmIBPxuFcOb-eOYCfLAlcx7EOzd7Y1gi_N_3w== Age: 29889 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 68 65 6c 70 2d 63 65 6e 74 65 72 2d 75 69 2d 77 65 62 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 61 35 33 63 64 66 62 22 5d 2c 7b 22 37 37 62 38 37 30 66 61 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 72 28 6e 29 2c 69 2e 64 28 6e 2c 7b 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 56 65 7d 7d 29 3b 76 61 72 20 74 3d 69 28 22 65 61 64 37 31 65 62 30 22 29 2c 61 3d 69 2e 6e 28 74 29 2c 72 3d 69 28 Data Ascii: "use strict";(self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]=self["b-help-center-ui-web__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7a53cdfb"],{"77b870fa":function(e,n,i){i.r(n),i.d(n,{default:function(){return Ve}});var t=i("ead71eb0"),a=i.n(t),r=i(
2024-01-15 23:17:06 UTC	16384	IN	Data Raw: 66 69 6c 74 65 72 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 61 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 Data Ascii: filters"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"name"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"value"},arguments:[],directives:[]}]}}]}},{kind:"InlineFrag
2024-01-15 23:17:06 UTC	10796	IN	Data Raw: 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 74 75 62 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 5d 29 29 2c 6c 6f 63 3a 7b 73 74 61 72 74 3a 30 2c 65 6e 64 3a 32 31 37 2c 73 6f 75 72 63 65 3a 7b 62 6f 64 79 3a 22 5c 6e 20 20 71 75 65 72 79 20 47 6c 6f 62 61 6c 41 6c 65 72 74 43 6f 6e 66 69 67 73 28 24 69 6e 70 75 74 3a 20 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 49 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 Data Ascii: tionSet",selections:[{kind:"Field",name:{kind:"Name",value:"stub"},arguments:[],directives:[]}]}}]}}]}}]}}]}}]}}]}}])),loc:{start:0,end:217,source:{body:"\n query GlobalAlertConfigs($input: MerchComponentsInput) {\n merchComponents(input: $input) {\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.5	50565	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	3034	OUT	POST /c360/v1/track HTTP/1.1 Host: secure.booking.com Connection: keep-alive Content-Length: 787 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: LvWlZQAAAAA=hrh3k6yYtgWUB48-Rr6XI7bYwrUM7JC8RA1RZcRh2fm2gndNvZY1g4XzW2dJ3yyWqULwErBR6Av_lq50kJNmHIrfOZJdmNz5KgItJNEzRc_QREUq9wqdDX3n1TCiWI0FKq006-B-42tFa46MmffSgM1f485f1qBllDxgjVGwyE_sPbkIIDFF2a9zcXa-D8jUAsFdBknNSBgCOw6T sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Booking-Pageview-Id: 6880a3b6d76d00c5 Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Origin: https://secure.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360621686; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwtU4iarpGKri8Cu9de16rTMmp4GFbPQpTDfcri4SVEhR5trIrkvNGBWVZHhLRjXkD2Swz2XAwHXwNWXgFsoTfpEotQ%2BVpT6E2SS5ppcL5GTQJVZV96mvnFhfA3TGwZL%2Bu9%2Bc%2Bh1V%2Biz%2Fow4rYv4BCYTexJ1EKDQHo%3D
2024-01-15 23:17:06 UTC	787	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 61 70 70 74 72 61 63 6b 2e 6c 61 6e 64 69 6e 67 5f 70 61 67 65 5f 66 75 6e 6e 65 6c 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 61 66 66 69 6c 69 61 74 65 5f 69 64 22 3a 22 33 30 34 31 34 32 22 2c 22 6c 61 62 65 6c 22 3a 22 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 77 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4b 34 2d 5a 61 74 42 73 41 43 41 64 49 43 4a 47 49 77 4e 7a 59 77 4e 6a 55 32 4c 54 63 7a 4f 54 49 74 4e 44 41 7a 59 79 30 35 4e 47 4a 6a 4c 54 6c 69 59 32 51 32 5a 44 49 35 4d 57 Data Ascii: {"events":[{"action_name":"apptrack.landing_page_funnel","action_version":"1.0.0","content":{"affiliate_id":"304142","label":"gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MW
2024-01-15 23:17:06 UTC	952	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 31 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:06 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://secure.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:06 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 cd691f5232ad8151e816e4693db0dfac.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: gLiNtdQZCYqoe8wgcoiJ10A-EkeQr1Qx6FD6eEzPDG4QenBo4zXPeA==
2024-01-15 23:17:06 UTC	31	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.5	50612	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	410	OUT	GET /static/img/nobg_all_blue_iq/b700d9e3067c1186a3364012df4fe1c48ae6da44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:06 UTC	745	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 73 Connection: close Server: nginx Date: Sat, 30 Dec 2023 21:58:35 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-49" Expires: Mon, 29 Jan 2024 21:58:35 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 4a21175361a1e842a337986b5f7399aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 5mAm9lZmODr7BvLzN1wxSfCfrC9GlKKKhgF663Atd58jd96hqVROCQ== Age: 1387111
2024-01-15 23:17:06 UTC	73	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 64 08 02 00 00 00 c8 4e cd 37 00 00 00 10 49 44 41 54 78 01 63 60 30 ad 1f 3c 78 14 03 00 c1 9e 46 51 38 13 50 b6 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRdN7IDATxc`0<xFQ8PIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.5	50614	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	689	OUT	OPTIONS /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id Origin: https://secure.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	1064	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id access-control-allow-methods: POST access-control-allow-origin: https://secure.booking.com strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ce06a3b9246e0198&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqss6FNPf-TUljmsFrtmLuJ5azkl5gG61Awg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 263d97c176fc51d1d08116820c013de4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: h22Q7_bxEzYFL4BvinPjoDG3XicsTVQ8fcGiNE8f8IbP5ini2SmXtA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.5	50616	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	3105	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&source=header&src=profile_contact_cs&lang=en-us HTTP/1.1 Host: secure.booking.com Connection: keep-alive Content-Length: 753 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNTM2MDYyMiwiZXhwIjoxNzA1NDQ3MDIyfQ.6Te8yrJ94skXBurSYIVZ8mS50M6Ato9SXhEbqSePNlY53TwhVvQlp4TasutpvYz-C7K2G_NRjkIrLazKz1lHfA x-booking-et-serialized-state: EQSguLSQdlH2VGSZ--k8SxYCWTSuvoUO3hEzuuu9y6M1rUBPlGXOXgC88OCke3VE2 x-booking-context-action-name: help x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 6880a3b6d76d00c5 accept: / x-booking-topic: capla_browser_b-help-center-ui-web sec-ch-ua-platform: "Windows" Origin: https://secure.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360621686; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCrRQJj4Vk7QFBPqoohKR3G%2BAO9fScOM6mPrwxLIbtoRfTlH265Wuzl9nyr46PnlTFujNG12Vk%2FBF%2BPZp0Reet%2FjYllO9WYFzdT1J%2BoU32%2F8iXGM9q0y3Lhc%2Fpxr76nmSu%2B2We7B0kmReR%2FbQ3f1ecB9rp4%2FpBtmnQQ%3D
2024-01-15 23:17:06 UTC	753	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 48 65 6c 70 43 65 6e 74 65 72 4c 6f 67 69 6e 4c 69 6e 6b 4f 6e 6c 79 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 74 6f 6b 65 6e 22 3a 22 22 2c 22 70 61 67 65 22 3a 22 68 6f 6d 65 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 77 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4b 34 2d 5a 61 74 42 73 41 43 41 64 49 43 4a 47 49 77 4e 7a 59 77 4e 6a 55 32 4c 54 63 7a 4f 54 49 74 4e 44 41 7a 59 79 30 35 4e 47 4a 6a 4c 54 6c 69 59 32 51 32 5a 44 49 35 4d 57 46 69 4e 74 67 43 42 65 41 43 41 51 26 73 69 64 3d 39 34 62 Data Ascii: {"operationName":"HelpCenterLoginLinkOnly","variables":{"input":{"token":"","page":"home?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b
2024-01-15 23:17:07 UTC	852	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 507 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmpxIJHJayPNmydJwAzRUiB%2FdOzFzIX1O6XJR9jqOF9Tl%2B1xv8nVEboYRP7spFf5apr8TlmEFT5fo9f3r%2FixvmenPNhK%2FAfx6m0IHwi96lQk5wn8g4NAEbCl3ovxXU%2FJ1o4pSqM4qE8AG5GcRyQsXv8uDmHX3B9TiM%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:07 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a41c564554b07cc8611f5945b432513a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: ENO91oOGrjF5j96j-MBwBGqXRLAWGdZoDTnUT1F59QbuhbLYd_FpNA==
2024-01-15 23:17:07 UTC	507	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 68 65 6c 70 63 65 6e 74 65 72 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 48 65 6c 70 43 65 6e 74 65 72 4f 75 74 70 75 74 22 2c 22 6c 6f 67 69 6e 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 61 75 74 68 2f 6f 61 75 74 68 32 3f 63 6c 69 65 6e 74 5f 69 64 3d 76 4f 31 4b 62 6c 6b 37 78 58 39 74 55 6e 32 63 70 5a 4c 53 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 25 32 46 6c 6f 67 69 6e 2e 68 74 6d 6c 25 33 46 6f 70 25 33 44 6f 61 75 74 68 5f 72 65 74 75 72 6e 26 6c 61 6e 67 3d 78 75 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 26 64 74 3d 31 37 30 35 33 36 30 Data Ascii: {"data":{"helpcenter":{"__typename":"HelpCenterOutput","loginLink":"https://account.booking.com/auth/oauth2?client_id=vO1Kblk7xX9tUn2cpZLS&redirect_uri=https%3A%2F%2Fsecure.booking.com%2Flogin.html%3Fop%3Doauth_return&lang=xu&response_type=code&dt=1705360

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.5	50615	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	2850	OUT	GET /js_tracking?ref_action=help&ver=2&stype=1&lang=en-us&pid=6880a3b6d76d00c5&ete=&etg=&etcg=&ets=HMbIWWPaDMRJLYZET\|1,HMbIKELcdEZYHRYKe\|1,HMbBaSFbeAFDCaceNTWYcMSPRXe\|4,HMbBaSFbeAFDCaceNTWYcMSPRXe\|8,HMbBaSFbeAFDCaceNTWYcMSPRXe\|6,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,HMbBVbXbTYJKSCHe\|1,HMbBVbXbTYJKSCHe\|2&etgwv= HTTP/1.1 Host: secure.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EQSguLSQdlH2VGSZ--k8SxYCWTSuvoUO3hEzuuu9y6M1rUBPlGXOXgC88OCke3VE2 X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 6880a3b6d76d00c5 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: 94b76ea7cb923e6da206675b5d1abbbd sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360621686; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCrRQJj4Vk7QFBPqoohKR3G%2BAO9fScOM6mPrwxLIbtoRfTlH265Wuzl9nyr46PnlTFujNG12Vk%2FBF%2BPZp0Reet%2FjYllO9WYFzdT1J%2BoU32%2F8iXGM9q0y3Lhc%2Fpxr76nmSu%2B2We7B0kmReR%2FbQ3f1ecB9rp4%2FpBtmnQQ%3D
2024-01-15 23:17:07 UTC	461	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c06dccfbc9bb974276058f2bb42421ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: LMuDUpx0jxIQAWNG72pOO5BUp94OacYpD8p4oRPW5aUrHdk2U__rdA==
2024-01-15 23:17:07 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.5	50617	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	689	OUT	OPTIONS /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id Origin: https://secure.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	1064	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id access-control-allow-methods: POST access-control-allow-origin: https://secure.booking.com strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c35aa3b9474c0104&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuO6QO9WDbburP6LNwQb5x78eyuJ_n7msc x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 5tqdHO4CoDYqmP7AFz_bbkTyzX7Ho5ffB2q5x4bI1F-1GzLKbDfGuw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.5	50618	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:06 UTC	689	OUT	OPTIONS /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id Origin: https://secure.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	1064	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-headers: content-type,x-booking-aid,x-booking-csrf,x-booking-et-seed,x-booking-label,x-booking-language-code,x-booking-pageview-id,x-booking-platform,x-booking-session-id,x-booking-sitetype-id access-control-allow-methods: POST access-control-allow-origin: https://secure.booking.com strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=10a4a3b9a9dc00a1&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssfbnIRuSlj0usu-eiQbufP90mtDopDylY x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5c91d033409cd7607633594f94b09064.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: QFDLyvldmxuUm7jPL4DndevZ6usu5jzCixt8TPW3XmRC8W4Zae026g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.5	50620	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	647	OUT	GET /static/img/b25logo/favicon/ebc77706da3aae4aee7b05dadf182390f0d26d11.ico HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	773	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1582 Connection: close Server: nginx Date: Tue, 02 Jan 2024 09:28:33 GMT Last-Modified: Wed, 10 Apr 2019 11:21:50 GMT Expires: Thu, 01 Feb 2024 09:28:33 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1ce-62e" X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: LOhXLw5hoD1yM6JOJJPDMyXNBRTUy5AxrP5Vuj3p9ky97L32bWSzIg== Age: 1172914
2024-01-15 23:17:07 UTC	1582	IN	Data Raw: 00 00 01 00 03 00 20 20 10 00 01 00 04 00 e8 02 00 00 36 00 00 00 18 18 10 00 01 00 04 00 e8 01 00 00 1e 03 00 00 10 10 10 00 01 00 04 00 28 01 00 00 06 05 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 00 02 00 00 12 0b 00 00 12 0b 00 00 10 00 00 00 10 00 00 00 80 35 00 00 92 4d 16 00 a1 6a 43 00 d8 9e 29 00 b3 86 67 00 ff fe fe 00 d1 b6 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6(( @5MjC)g'ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.5	50619	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2716	OUT	POST /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ref_action=help&pid=6880a3b6d76d00c5&stype=1&lang=en-us&ver=2&aid=304142&m=UmFuZG9tSVYkc2RlIyh9YQNcFzDQ3JSun3Qy_smY43fuAGTvBgN4LflpwzIpPoohGF1CCvVXxBSRJQVJkag9AWYU9VfB6XJIhFThxH05tfoh6d2GnOkM0ZpWMpsPDKUWilnyz9TkVxfBDmQCPKQSAelf1mz3MHclSYpvvT3Ovek06EVbxX_UPGBogVHnUgXkwn6XQvuSA7rH2ZyFdgaSDTK0gBRDXJ3h2JK0VOSUMpq0QCCSU5Ompw&etgwv=js_onload_resource_transfer_size%7C356&_=1705360626348 HTTP/1.1 Host: secure.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; PegaIAC=IACtest; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D
2024-01-15 23:17:07 UTC	461	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d256d517610f633eae85f1fada59368e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: fJne2t3GGT4hkC_J2TyWLVfZrDxwC3Pwz7kZ__MomO5AO1yJy_Wzqw==
2024-01-15 23:17:07 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.5	50621	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	637	OUT	GET /consent/04f32d9e-1729-4d42-82b5-91c2350ff323/04f32d9e-1729-4d42-82b5-91c2350ff323.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:07 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d48fffaf20a5-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 30630 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:07 GMT Last-Modified: Wed, 06 Sep 2023 13:29:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: jP87YNX2JlBTeAw0Zi9FYA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: deea2c06-a01e-008f-59b5-21b0e9000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:07 UTC	467	IN	Data Raw: 31 39 64 35 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 30 38 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 30 34 66 33 Data Ascii: 19d5{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"04f3
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 20 2b 20 52 75 73 73 69 61 20 2b 20 55 4b 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 6e 6f 22 2c 22 64 65 22 2c 22 72 75 22 2c 22 62 65 22 2c 22 66 69 22 2c 22 70 74 22 2c 22 62 67 22 2c 22 64 6b 22 2c 22 6c 74 22 2c 22 6c 75 22 2c 22 68 72 22 2c 22 6c 76 22 2c 22 66 72 22 2c 22 68 75 22 2c 22 73 65 22 2c 22 73 69 22 2c 22 6d 63 22 2c 22 73 6b 22 2c 22 6d 66 22 2c 22 73 6d 22 2c 22 67 62 22 2c 22 79 74 22 2c 22 69 65 22 2c 22 67 66 22 2c 22 65 65 22 2c 22 6d 71 22 2c 22 6d 74 22 2c 22 67 70 22 2c 22 69 73 22 2c 22 69 74 22 2c 22 67 72 22 2c 22 65 73 22 2c 22 61 74 22 2c 22 72 65 22 2c 22 63 79 22 2c 22 61 78 22 2c 22 63 7a 22 2c 22 70 6c 22 2c 22 6c 69 22 2c 22 72 6f 22 2c 22 6e 6c 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 Data Ascii: + Russia + UK","Countries":["no","de","ru","be","fi","pt","bg","dk","lt","lu","hr","lv","fr","hu","se","si","mc","sk","mf","sm","gb","yt","ie","gf","ee","mq","mt","gp","is","it","gr","es","at","re","cy","ax","cz","pl","li","ro","nl"],"States":{},"Languag
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-01-15 23:17:07 UTC	678	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"CookieV2VendorServiceScr
2024-01-15 23:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.5	50622	108.138.85.49	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2462	OUT	GET /c360/v1/track HTTP/1.1 Host: secure.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; PegaIAC=IACtest; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:17:07 UTC	426	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7f211c0cbc2233e773b715bc4f4a435c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: spQ18o5yhJNyKRU4hrBkoUy-MPdz6H-8lEJ-aEUQJlvqiM92Gh7T6A==
2024-01-15 23:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.5	50623	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	3304	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 810 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 6880a3b6d76d00c5 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D
2024-01-15 23:17:07 UTC	810	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 61 72 64 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 61 61 33 61 62 61 39 64 2d 38 66 33 64 2d 34 38 34 38 2d 62 35 65 35 2d 36 63 61 31 31 66 64 38 33 65 34 33 22 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 47 6c 6f 62 61 6c 22 2c 22 65 78 70 61 6e 64 65 64 22 3a 74 72 75 65 2c 22 74 68 65 6d 65 22 3a 22 4e 6f 72 6d 61 6c 22 7d 5d 2c 22 70 61 67 65 5f 72 65 67 69 6f 6e 22 3a 22 48 65 6c 70 43 65 6e 74 65 72 48 6f 6d 65 50 61 67 Data Ascii: {"action_name":"webcoreux.global_alert_component_served","action_version":"2.0.0","content":{"global_alert_card":[{"campaign_id":"aa3aba9d-8f3d-4848-b5e5-6ca11fd83e43","category":"Global","expanded":true,"theme":"Normal"}],"page_region":"HelpCenterHomePag
2024-01-15 23:17:07 UTC	1192	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://secure.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VsDLWAwFe0GWRU%2BCjZnSa6%2BvMjw0BijJRv0B%2Fg74qnJE%2Bk35QBQNIh%2FXmgVXicO37c6WiX9FiRDLDK2amY5hLPUCJhA4o2UrlSLsSPc%2FAaHgB4pH3O9WT%2FrPcB1g9i5f%2B0swJHXeHp4dKs8gkoBFsPwTMm5g%2FczWU%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:07 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4ebda3b9fa36003c&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsviXALIbfxp4FlFUKRuPltuF7G1FFNw0IQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c6b0d1d85b2590c57ac754bf9e61944e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: StUZhXYo40KCbbVeVk78TtzlGMKYJ65hztjvzdsiiNOv4r3DouJZUA==
2024-01-15 23:17:07 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.5	50624	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	3304	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 810 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 6880a3b6d76d00c5 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D
2024-01-15 23:17:07 UTC	810	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 61 72 64 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 61 61 33 61 62 61 39 64 2d 38 66 33 64 2d 34 38 34 38 2d 62 35 65 35 2d 36 63 61 31 31 66 64 38 33 65 34 33 22 2c 22 63 61 74 65 67 6f 72 79 22 3a 22 47 6c 6f 62 61 6c 22 2c 22 65 78 70 61 6e 64 65 64 22 3a 74 72 75 65 2c 22 74 68 65 6d 65 22 3a 22 4e 6f 72 6d 61 6c 22 7d 5d 2c 22 70 61 67 65 5f 72 65 67 69 6f 6e 22 3a 22 48 65 6c 70 43 65 6e 74 65 72 48 6f 6d 65 50 61 67 Data Ascii: {"action_name":"webcoreux.global_alert_component_served","action_version":"2.0.0","content":{"global_alert_card":[{"campaign_id":"aa3aba9d-8f3d-4848-b5e5-6ca11fd83e43","category":"Global","expanded":true,"theme":"Normal"}],"page_region":"HelpCenterHomePag
2024-01-15 23:17:07 UTC	1178	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://secure.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0Tz%2BfMxqSD92roYvTH3fDlcX0AipOEVj6QCXzyPdTIHtlGvzO3JiBl3YPIu%2F5f6QS%2BepiFEt0PAqkr7FttWXDzbruumCaI92sffINdQdeLlsw%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:07 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b3c9a3b9f8fc0033&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqst9PLzMYGDSyiQazaIqrZY_npVTMOc8sfE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7f7e359e1c06a914d3d305785359b84c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: t6huTh5ptcCYodC3C7zd8nIwNo7fYBknMb9wis1MInaGa879zIgtlg==
2024-01-15 23:17:07 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.5	50625	13.249.39.92	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	3304	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 681 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 6880a3b6d76d00c5 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D
2024-01-15 23:17:07 UTC	681	OUT	Data Raw: 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 67 6c 6f 62 61 6c 5f 61 6c 65 72 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 61 61 33 61 62 61 39 64 2d 38 66 33 64 2d 34 38 34 38 2d 62 35 65 35 2d 36 63 61 31 31 66 64 38 33 65 34 33 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 68 65 6c 70 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d Data Ascii: {"action_name":"webcoreux.global_alert_component_viewed","action_version":"2.0.0","content":{"campaign_id":"aa3aba9d-8f3d-4848-b5e5-6ca11fd83e43"},"context":{"page":{"page_referrer":"","page_url":"https://secure.booking.com/help?aid=304142&label=gen173nr-
2024-01-15 23:17:07 UTC	1180	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 29 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://secure.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT%2B1DjwVO8s1W3Vh1YffglFV7hdrkLOf781qqr5y%2FqrFuxULU3MWxPLRP5twJnQl3jVZdiDH3W5cWlk%2BGCO7zKNpEVSfgnALbOwdcxhFrv34Kp2xyC1CTQ0bVsGL9yKfdOBMyPhJpMEi4%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:07 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1047a3b9e8a20150&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstuOwL6pXMsNtuuy3HPY4uEUSk2ZfbrYD8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6bc1c280aeef9bbdeb102c7f4e4f773e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: qYfHhGO_bwsMwD8tYoelwOka34FJ_VQ7W5BcjsPqESNeT0m2lPnYKQ==
2024-01-15 23:17:07 UTC	29	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d Data Ascii: {"status":1,"content":"Sent"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.5	50626	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	603	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://secure.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	370	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:07 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d4930ca76fec-IAD
2024-01-15 23:17:07 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.5	50628	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	427	OUT	GET /consent/04f32d9e-1729-4d42-82b5-91c2350ff323/04f32d9e-1729-4d42-82b5-91c2350ff323.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:07 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d493afb3173d-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 25226 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:07 GMT Last-Modified: Wed, 06 Sep 2023 13:29:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: jP87YNX2JlBTeAw0Zi9FYA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 64fea8bc-d01e-002c-7be6-11d52c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:07 UTC	467	IN	Data Raw: 31 39 64 35 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 30 38 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 30 34 66 33 Data Ascii: 19d5{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"04f3
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 20 2b 20 52 75 73 73 69 61 20 2b 20 55 4b 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 6e 6f 22 2c 22 64 65 22 2c 22 72 75 22 2c 22 62 65 22 2c 22 66 69 22 2c 22 70 74 22 2c 22 62 67 22 2c 22 64 6b 22 2c 22 6c 74 22 2c 22 6c 75 22 2c 22 68 72 22 2c 22 6c 76 22 2c 22 66 72 22 2c 22 68 75 22 2c 22 73 65 22 2c 22 73 69 22 2c 22 6d 63 22 2c 22 73 6b 22 2c 22 6d 66 22 2c 22 73 6d 22 2c 22 67 62 22 2c 22 79 74 22 2c 22 69 65 22 2c 22 67 66 22 2c 22 65 65 22 2c 22 6d 71 22 2c 22 6d 74 22 2c 22 67 70 22 2c 22 69 73 22 2c 22 69 74 22 2c 22 67 72 22 2c 22 65 73 22 2c 22 61 74 22 2c 22 72 65 22 2c 22 63 79 22 2c 22 61 78 22 2c 22 63 7a 22 2c 22 70 6c 22 2c 22 6c 69 22 2c 22 72 6f 22 2c 22 6e 6c 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 Data Ascii: + Russia + UK","Countries":["no","de","ru","be","fi","pt","bg","dk","lt","lu","hr","lv","fr","hu","se","si","mc","sk","mf","sm","gb","yt","ie","gf","ee","mq","mt","gp","is","it","gr","es","at","re","cy","ax","cz","pl","li","ro","nl"],"States":{},"Languag
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-01-15 23:17:07 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-01-15 23:17:07 UTC	678	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"CookieV2VendorServiceScr
2024-01-15 23:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.5	50627	108.138.85.49	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2753	OUT	GET /js_tracking?ref_action=help&ver=2&stype=1&lang=en-us&pid=6880a3b6d76d00c5&ete=&etg=&etcg=&ets=HMbIWWPaDMRJLYZET\|1,HMbIKELcdEZYHRYKe\|1,HMbBaSFbeAFDCaceNTWYcMSPRXe\|4,HMbBaSFbeAFDCaceNTWYcMSPRXe\|8,HMbBaSFbeAFDCaceNTWYcMSPRXe\|6,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,HMbBVbXbTYJKSCHe\|1,HMbBVbXbTYJKSCHe\|2&etgwv= HTTP/1.1 Host: secure.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; PegaIAC=IACtest; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPedEDDewyQ14E0jOxY1Qgz7dyz388r2vWpclseyDB7%2B3hwaX%2FtBsADhQAZOKIaZMgm%2BPzmFVfkiK%2BHJEozyuZo9vIoI1nLo1oBYnBq%2FEGH1HegqhuHMkFelytjgv9UWbvQ5SESxn%2FximWeRSreEz387%2FeoSobYenBX8%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-01-15 23:17:07 UTC	461	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 71c1b7cb74a6a3840a4f2be73ffddc84.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: IVuYL5N-SKGPVBwrc79yEcbMNa_iB6DR5Km1mJVeB1kdyseFzorH5w==
2024-01-15 23:17:07 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.5	50629	108.138.85.49	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2700	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&sid=94b76ea7cb923e6da206675b5d1abbbd&source=header&src=profile_contact_cs&lang=en-us HTTP/1.1 Host: secure.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; PegaIAC=IACtest; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmpxIJHJayPNmydJwAzRUiB%2FdOzFzIX1O6XJR9jqOF9Tl%2B1xv8nVEboYRP7spFf5apr8TlmEFT5fo9f3r%2FixvmenPNhK%2FAfx6m0IHwi96lQk5wn8g4NAEbCl3ovxXU%2FJ1o4pSqM4qE8AG5GcRyQsXv8uDmHX3B9TiM%3D
2024-01-15 23:17:07 UTC	426	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:07 GMT strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 c59b5a542015c208c95d2ed3c65cdbcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: xnvRXAwkFF1DPc8E0-Ispz3m93s8zHAO-0NQhQQdgQbieePlGKYNBw==
2024-01-15 23:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.5	50630	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	409	OUT	GET /static/img/b25logo/favicon/ebc77706da3aae4aee7b05dadf182390f0d26d11.ico HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:07 UTC	773	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1582 Connection: close Server: nginx Date: Tue, 02 Jan 2024 09:28:33 GMT Last-Modified: Wed, 10 Apr 2019 11:21:50 GMT Expires: Thu, 01 Feb 2024 09:28:33 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1ce-62e" X-Cache: Hit from cloudfront Via: 1.1 e0ed595b39732d9e9972db26854384ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 8zBltP46j7bAN0vOb_r34ib3W1ZY3i4AnNRdZOkKQR0AXXH19gvWEw== Age: 1172914
2024-01-15 23:17:07 UTC	1582	IN	Data Raw: 00 00 01 00 03 00 20 20 10 00 01 00 04 00 e8 02 00 00 36 00 00 00 18 18 10 00 01 00 04 00 e8 01 00 00 1e 03 00 00 10 10 10 00 01 00 04 00 28 01 00 00 06 05 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 00 02 00 00 12 0b 00 00 12 0b 00 00 10 00 00 00 10 00 00 00 80 35 00 00 92 4d 16 00 a1 6a 43 00 d8 9e 29 00 b3 86 67 00 ff fe fe 00 d1 b6 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6(( @5MjC)g'ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.5	50633	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	560	OUT	GET /scripttemplates/202308.1.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:08 UTC	815	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:08 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: 2+I2Cj649lHjQKiedh8F2Q== Last-Modified: Wed, 25 Oct 2023 03:55:47 GMT x-ms-request-id: 722cf87a-c01e-0042-458a-2f8003000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14755 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d4960d87084b-IAD
2024-01-15 23:17:08 UTC	554	IN	Data Raw: 37 63 37 32 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 33 30 38 2e 31 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 33 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 4e 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c72/** * onetrust-banner-sdk * v202308.1.0 * by OneTrust LLC * Copyright 2023 */!function(){"use strict";var N=function(e,t){return(N=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 46 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 73 2c 61 2c 6c 29 7b 72 65 74 75 72 6e 20 6e 65 Data Ascii: otype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return ne
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4d 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 2c 74 3d 30 2c 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 65 2b 3d 61 72 Data Ascii: l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function M(){for(var e=0,t=0,o=arguments.length;t<o;t++)e+=ar
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 63 65 6f 66 20 4b 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 58 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 24 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 58 28 74 29 7d 63 61 74 63 68 28 65 29 7b 59 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 59 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 6c 75 65 3d 74 2c 58 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 32 3d 3d 3d 65 2e 5f 73 74 61 74 65 26 26 30 3d 3d Data Ascii: ceof K)return t._state=3,t._value=e,void X(t);if("function"==typeof o)return void $((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,X(t)}catch(e){Y(t,e)}var n,r}function Y(e,t){e._state=2,e._value=t,X(e)}function X(e){2===e._state&&0==
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 4b 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4b 3f 74 3a 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 4b 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 28 6f 29 7d 29 7d 2c 4b 2e 72 61 63 65 3d 66 75 6e 63 Data Ascii: eturn void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},K.resolve=function(t){return t&&"object"==typeof t&&t.constructor===K?t:new K(function(e){e(t)})},K.reject=function(o){return new K(function(e,t){t(o)})},K.race=func
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 Data Ascii: e:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 Data Ascii: .initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 3d 22 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 22 2c 28 65 3d 6e 65 3d 6e 65 7c 7c 7b 7d 29 5b 65 2e 50 75 72 70 6f 73 65 3d 31 Data Ascii: e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=te=te\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=oe=oe\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateConsent="UpdateConsent",(e=ne=ne\|\|{})[e.Purpose=1
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 65 5b 65 5b 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 5d 3d 37 5d 3d 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 2c 28 65 3d 68 65 3d 68 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 2e 48 6f 73 74 3d 22 48 6f 73 74 22 2c 65 2e 47 65 6e 56 65 6e 64 6f 72 3d 22 47 65 6e 56 65 6e 22 2c 28 65 3d 79 65 3d 79 65 7c 7c 7b 7d 29 5b 65 2e 48 6f 73 74 3d 31 5d 3d 22 48 6f 73 74 22 2c 65 5b 65 2e 47 65 6e 56 65 6e 3d 32 5d 3d 22 47 65 6e 56 65 6e 22 2c 65 Data Ascii: ["Preference Center - Confirm"]=6]="Preference Center - Confirm",e[e["GPC value changed"]=7]="GPC value changed",(e=he=he\|\|{}).Active="1",e.InActive="0",(e=Ce=Ce\|\|{}).Host="Host",e.GenVendor="GenVen",(e=ye=ye\|\|{})[e.Host=1]="Host",e[e.GenVen=2]="GenVen",e
2024-01-15 23:17:08 UTC	1369	IN	Data Raw: 65 67 61 6c 42 61 73 69 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 63 6f 6f 6b 69 65 73 3d 22 63 6f 6f 6b 69 65 73 22 2c 65 2e 76 65 6e 64 6f 72 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 45 65 3d 45 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 49 41 42 3d 22 49 41 42 22 2c 65 2e 43 43 50 41 3d 22 43 43 50 41 22 2c 65 2e 49 41 42 32 3d 22 49 41 42 32 22 2c 65 2e 49 41 42 32 56 32 3d 22 49 41 42 32 56 32 22 2c 65 2e 47 45 4e 45 52 49 43 3d 22 47 45 4e 45 52 49 43 22 2c 65 2e 4c 47 50 44 3d 22 4c 47 50 44 22 2c 65 2e 47 45 4e 45 52 49 43 5f 50 52 4f 4d 50 54 3d 22 47 45 4e 45 52 49 43 5f 50 52 4f 4d 50 54 22 2c 65 2e 43 50 52 41 3d 22 43 50 52 41 22 2c 65 2e 43 44 50 41 3d 22 43 44 50 41 22 2c 65 2e 55 53 4e 41 54 49 4f 4e 41 4c Data Ascii: egalBasis",(e=_e=_e\|\|{}).cookies="cookies",e.vendors="vendors",(e=Ee=Ee\|\|{}).GDPR="GDPR",e.IAB="IAB",e.CCPA="CCPA",e.IAB2="IAB2",e.IAB2V2="IAB2V2",e.GENERIC="GENERIC",e.LGPD="LGPD",e.GENERIC_PROMPT="GENERIC_PROMPT",e.CPRA="CPRA",e.CDPA="CDPA",e.USNATIONAL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.5	50632	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2981	OUT	POST /navigation_times HTTP/1.1 Host: secure.booking.com Connection: keep-alive Content-Length: 421 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: LvWlZQAAAAA=hrh3k6yYtgWUB48-Rr6XI7bYwrUM7JC8RA1RZcRh2fm2gndNvZY1g4XzW2dJ3yyWqULwErBR6Av_lq50kJNmHIrfOZJdmNz5KgItJNEzRc_QREUq9wqdDX3n1TCiWI0FKq006-B-42tFa46MmffSgM1f485f1qBllDxgjVGwyE_sPbkIIDFF2a9zcXa-D8jUAsFdBknNSBgCOw6T sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=0; PegaIAC=IACtest; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzmpxIJHJayPNmydJwAzRUiB%2FdOzFzIX1O6XJR9jqOF9Tl%2B1xv8nVEboYRP7spFf5apr8TlmEFT5fo9f3r%2FixvmenPNhK%2FAfx6m0IHwi96lQk5wn8g4NAEbCl3ovxXU%2FJ1o4pSqM4qE8AG5GcRyQsXv8uDmHX3B9TiM%3D
2024-01-15 23:17:07 UTC	421	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 68 65 6c 70 26 70 69 64 3d 36 38 38 30 61 33 62 36 64 37 36 64 30 30 63 35 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 64 6e 3d 63 66 26 64 63 3d 35 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 36 32 30 38 33 38 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 35 33 36 30 36 32 30 38 34 34 25 32 43 31 37 30 35 33 36 30 36 32 30 39 35 38 25 32 43 31 37 30 35 33 36 30 36 32 31 30 37 37 25 32 43 31 37 30 35 33 36 30 36 32 31 30 37 37 25 32 43 31 37 30 35 33 36 30 36 32 31 33 34 30 25 32 43 31 37 30 35 33 36 30 36 32 31 30 37 39 25 32 43 31 37 30 35 33 36 30 36 32 31 33 34 32 25 32 43 31 37 30 35 33 Data Ascii: ref_action=help&pid=6880a3b6d76d00c5&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&cdn=cf&dc=5&nts=0%2C0%2C1705360620838%2C0%2C0%2C0%2C0%2C1705360620844%2C1705360620958%2C1705360621077%2C1705360621077%2C1705360621340%2C1705360621079%2C1705360621342%2C17053
2024-01-15 23:17:08 UTC	800	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:08 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; domain=.booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:08 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 687f50ed8be10041d824dc8ad7bb0622.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: fg81O2-HVCT6xcMhlSYXVm3zDnByViJX6aEFtYgahQk71oAmVuCxzw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.5	50631	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:08 UTC	249	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:08 GMT Content-Type: text/javascript Content-Length: 92 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d49619be3b41-IAD
2024-01-15 23:17:08 UTC	92	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.5	50634	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:07 UTC	2782	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3VsDLWAwFe0GWRU%2BCjZnSa6%2BvMjw0BijJRv0B%2Fg74qnJE%2Bk35QBQNIh%2FXmgVXicO37c6WiX9FiRDLDK2amY5hLPUCJhA4o2UrlSLsSPc%2FAaHgB4pH3O9WT%2FrPcB1g9i5f%2B0swJHXeHp4dKs8gkoBFsPwTMm5g%2FczWU%3D
2024-01-15 23:17:08 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:08 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=68d0a3ba6fe502a9&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu4PAnAyLVHIfwpe4hIy6irQHBHUIs9-ys x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 dd169cfdbbafbb3da513bede6bc6640e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: aqTCSX346JGGySWFF5cR1ZGJFfZvaBSGqOj6uR9STOefVmPwjNMZjQ==
2024-01-15 23:17:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.5	50635	52.85.132.115	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive Content-Length: 3097 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:08 UTC	3097	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6e 59 2b 6a 41 50 63 53 41 41 41 41 3a 71 75 57 66 2b 6b 2b 2f 63 42 34 58 53 39 30 52 38 68 75 59 41 6c 6b 4c 54 51 65 4b 68 50 65 30 42 62 31 36 43 48 63 4b 2b 72 55 4b 53 42 42 46 59 2b 4c 55 73 35 79 63 77 6a 2b 6a 54 77 4c 59 35 31 34 66 4c 2b 39 47 37 6b 49 6d 7a 68 48 45 5a 41 58 69 70 6f 6d 4f 7a 69 39 37 56 4d 77 36 56 65 35 6b 4b 6c 31 53 5a 62 32 34 54 33 45 58 52 57 6c 4b 47 59 33 38 64 34 61 54 76 50 59 50 31 45 69 4f 69 2b 6d 45 6b 48 55 6c 4b 5a 56 4e 6d 30 64 5a 43 77 6b 4f 62 41 70 48 49 6d 42 4a 5a 6e 51 70 63 31 76 57 4f 55 75 45 41 30 76 38 6c 6f 41 75 38 34 Data Ascii: {"existing_token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAnY+jAPcSAAAA:quWf+k+/cB4XS90R8huYAlkLTQeKhPe0Bb16CHcK+rUKSBBFY+LUs5ycwj+jTwLY514fL+9G7kImzhHEZAXipomOzi97VMw6Ve5kKl1SZb24T3EXRWlKGY38d4aTvPYP1EiOi+mEkHUlKZVNm0dZCwkObApHImBJZnQpc1vWOUuEA0v8loAu84
2024-01-15 23:17:08 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Mon, 15 Jan 2024 23:17:08 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65a5bcf4-173a0d2737e6ab6732db6b13 X-Cache: Miss from cloudfront Via: 1.1 65515d7b1028cd133489fb761d35fa06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: hPDSWl53gH3zXJxy3s-XmZ66IhTKiLxwxoUr9Ez-TGAfPoQ9GSsgBQ==
2024-01-15 23:17:08 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 39 37 66 61 62 30 30 32 2d 36 34 35 61 2d 34 37 66 38 2d 61 61 38 31 2d 33 32 63 31 37 62 37 61 39 62 36 31 3a 45 51 6f 41 6e 4e 53 69 65 63 77 30 41 41 41 41 3a 33 4f 6e 68 79 35 2f 2b 6c 74 35 32 62 71 72 64 74 34 4d 6e 7a 43 30 52 45 43 46 4a 6d 55 6f 38 58 41 72 65 51 2f 35 64 66 6f 70 6f 74 6a 35 51 41 55 55 71 63 79 56 4b 63 6a 2b 4c 6d 52 31 45 75 38 61 78 77 76 70 71 58 6a 59 63 32 62 50 67 39 4e 4f 70 56 61 42 68 36 72 62 34 38 62 4e 6c 49 74 50 2b 32 6f 57 66 32 52 55 72 48 67 6c 6c 55 76 48 61 44 77 74 6b 44 77 45 5a 6d 37 58 62 49 44 42 2f 51 53 46 6f 66 45 57 39 6e 79 76 35 4d 65 6a 65 6b 6c 67 70 31 67 2b 54 33 41 79 6c 53 54 46 79 72 51 2f 76 46 6e 4f 49 74 41 6e 70 65 37 50 2f 45 6d 75 7a 38 66 35 6e 66 41 52 Data Ascii: {"token":"97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAnNSiecw0AAAA:3Onhy5/+lt52bqrdt4MnzC0RECFJmUo8XAreQ/5dfopotj5QAUUqcyVKcj+LmR1Eu8axwvpqXjYc2bPg9NOpVaBh6rb48bNlItP+2oWf2RUrHgllUvHaDwtkDwEZm7XbIDB/QSFofEW9nyv5Mejeklgp1g+T3AylSTFyrQ/vFnOItAnpe7P/Emuz8f5nfAR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.5	50636	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 955 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:08 UTC	955	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 30 36 62 31 63 62 35 31 2d 31 64 35 34 2d 34 39 34 34 2d 62 66 65 37 2d 30 31 34 33 39 33 66 30 35 34 33 63 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"06b1cb51-1d54-4944-bfe7-014393f0543c","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","df":true,"s
2024-01-15 23:17:08 UTC	482	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:08 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.5	50637	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	2768	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCryp8CDWmrzTke5Apk3cfEFjyUUpJsaX1fKPaGHP9mJUdPpoUJViy0Tz%2BfMxqSD92roYvTH3fDlcX0AipOEVj6QCXzyPdTIHtlGvzO3JiBl3YPIu%2F5f6QS%2BepiFEt0PAqkr7FttWXDzbruumCaI92sffINdQdeLlsw%3D
2024-01-15 23:17:08 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:08 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=27d7a3ba4e4c0147&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssGdQsqGL_GoQmZKhdVKJxyqb-ke_ikakE x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6b7e1e42d74fd61097787cc6c1a37c34.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: pum1k_7V4TcVTT0tBYLumI8HaQSWfhoc73eFVPzkIDnhkanfGeeGig==
2024-01-15 23:17:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.5	50638	18.164.96.33	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	2582	OUT	GET /?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b5d1abbbd&utm_medium=frontend&utm_source=topbar HTTP/1.1 Host: join.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT%2B1DjwVO8s1W3Vh1YffglFV7hdrkLOf781qqr5y%2FqrFuxULU3MWxPLRP5twJnQl3jVZdiDH3W5cWlk%2BGCO7zKNpEVSfgnALbOwdcxhFrv34Kp2xyC1CTQ0bVsGL9yKfdOBMyPhJpMEi4%3D; lastSeen=1705360627956
2024-01-15 23:17:09 UTC	1271	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:09 GMT vary: Accept-Encoding nel: {"report_to":"default","max_age":604800} report-to: {"max_age":604800,"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}]} set-cookie: esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; domain=booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:09 GMT; SameSite=Lax; secure; HttpOnly; Secure set-cookie: he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D; domain=booking.com; path=/; expires=Sat, 13-Jan-2029 23:17:09 GMT; SameSite=Lax; secure; HttpOnly; Secure x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-joinapptag: e7b460bd7b06f066dc8f8ee445bfc796eb1d127c x-ua-compatible: IE=edge set-cookie: slan=xu; path=/; expires=Wed, 18-May-2033 03:33:20 GMT; HttpOnly; Secure strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d8e93128b8c3fa45992684bc1f50eeb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: grCfGMuZbrxmyMTIO6goL8ZOC1tZaGmTIWegwE6tt4sxTieDvvDvZw==
2024-01-15 23:17:09 UTC	15113	IN	Data Raw: 37 63 30 62 0d 0a 0a 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 2f 3e 3c 6d 65 74 61 20 64 61 74 61 2d 72 65 61 63 74 2d 68 65 6c 6d 65 74 3d 22 74 72 75 65 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 7c0b<!doctype html><html dir="ltr" lang="en-us"><head> <meta data-react-helmet="true" charset="utf-8"/><meta data-react-helmet="true" http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/><meta data-react-helmet="true" name="viewport" content=
2024-01-15 23:17:09 UTC	16384	IN	Data Raw: 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 6f 69 6e 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 61 6d 70 3b 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 77 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4b 34 2d 5a 61 74 42 73 41 43 41 64 49 43 4a 47 49 77 4e 7a 59 77 4e 6a 55 32 4c 54 63 7a 4f 54 49 74 4e 44 41 7a 59 79 30 35 4e 47 4a 6a 4c 54 6c 69 59 32 51 32 5a 44 49 35 4d 57 46 69 4e 74 67 43 42 65 41 43 41 51 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 2d 75 73 26 61 6d 70 3b 73 69 64 3d 39 34 62 37 36 65 61 37 63 62 39 32 33 65 36 64 61 32 30 36 36 37 35 62 Data Ascii: l" href="https://join.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b
2024-01-15 23:17:09 UTC	266	IN	Data Raw: 6c 6c 2d 72 75 6c 65 3d 22 6e 6f 6e 7a 65 72 6f 22 3e 3c 70 61 74 68 20 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3d 22 2e 35 22 20 64 3d 22 4d 31 38 2e 35 20 33 36 2e 37 39 33 30 30 39 33 33 4c 31 31 2e 39 38 34 35 36 32 35 20 34 32 2e 35 20 35 2e 35 20 33 36 2e 37 39 33 30 30 39 33 33 6c 31 2e 30 39 31 31 38 37 35 2d 31 2e 32 39 32 35 39 38 34 36 20 35 2e 33 39 33 33 37 35 20 34 2e 36 39 37 38 39 32 38 32 4c 31 37 2e 33 37 37 35 33 31 32 35 20 33 35 2e 35 7a 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 2e 35 20 34 33 2e 37 39 33 30 30 39 33 33 4c 31 31 2e 39 38 34 35 36 32 35 20 34 39 2e 35 20 35 2e 35 20 34 33 2e 37 39 33 30 30 39 33 33 6c 31 2e 30 39 31 31 38 37 35 2d 31 2e 32 39 32 35 39 38 34 36 20 35 2e 33 39 33 33 37 35 20 34 2e 36 39 Data Ascii: ll-rule="nonzero"><path fill-opacity=".5" d="M18.5 36.79300933L11.9845625 42.5 5.5 36.79300933l1.0911875-1.29259846 5.393375 4.69789282L17.37753125 35.5z"></path><path d="M18.5 43.79300933L11.9845625 49.5 5.5 43.79300933l1.0911875-1.29259846 5.393375 4.69
2024-01-15 23:17:09 UTC	16384	IN	Data Raw: 37 66 66 61 0d 0a 2e 33 37 37 35 33 31 32 35 20 34 32 2e 35 7a 22 3e 3c 2f 70 61 74 68 3e 3c 2f 67 3e 3c 2f 67 3e 3c 2f 73 76 67 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 30 35 34 62 36 65 39 37 66 22 20 69 64 3d 22 61 75 74 6f 6d 61 74 69 6f 6e 5f 69 64 5f 68 65 72 6f 5f 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 66 62 39 63 33 64 36 61 33 20 64 62 64 33 62 34 31 65 61 65 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 63 61 30 61 64 65 32 31 34 20 62 32 33 63 33 66 34 38 30 61 20 63 32 39 33 31 66 34 31 38 32 20 63 32 37 65 35 64 33 30 35 64 20 64 62 31 35 30 66 65 63 65 34 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 38 31 37 30 39 30 35 35 30 20 62 37 33 36 65 39 65 33 66 34 22 3e 3c 64 69 Data Ascii: 7ffa.37753125 42.5z"></path></g></g></svg></div></div><div class="f054b6e97f" id="automation_id_hero_container"><div class="ffb9c3d6a3 dbd3b41eae"><div class="aca0ade214 b23c3f480a c2931f4182 c27e5d305d db150fece4"><div class="b817090550 b736e9e3f4"><di
2024-01-15 23:17:09 UTC	16384	IN	Data Raw: 33 2e 31 30 39 2e 30 2f 69 6c 6c 75 73 74 72 61 74 69 6f 6e 73 2d 70 61 72 74 6e 65 72 2d 74 68 75 6d 62 6e 61 69 6c 73 2f 42 61 73 69 63 53 65 74 75 70 45 6d 70 74 79 53 74 61 74 65 2e 70 6e 67 22 20 73 72 63 53 65 74 3d 22 68 74 74 70 73 3a 2f 2f 74 2d 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 64 65 73 69 67 6e 2d 61 73 73 65 74 73 2f 61 73 73 65 74 73 2f 76 33 2e 31 30 39 2e 30 2f 69 6c 6c 75 73 74 72 61 74 69 6f 6e 73 2d 70 61 72 74 6e 65 72 2d 74 68 75 6d 62 6e 61 69 6c 73 2f 42 61 73 69 63 53 65 74 75 70 45 6d 70 74 79 53 74 61 74 65 40 32 78 2e 70 6e 67 20 32 78 22 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 6c 6f 61 64 69 6e 67 3d 22 6c 61 7a 79 22 2f 3e 3c 2f 70 69 63 74 75 72 65 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 Data Ascii: 3.109.0/illustrations-partner-thumbnails/BasicSetupEmptyState.png" srcSet="https://t-cf.bstatic.com/design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BasicSetupEmptyState@2x.png 2x" role="presentation" loading="lazy"/></picture></div><div cla
2024-01-15 23:17:09 UTC	16384	IN	Data Raw: 0d 0a 37 66 63 30 0d 0a 31 61 34 32 65 22 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 61 38 62 35 37 61 64 33 66 66 20 64 35 30 63 34 31 32 64 33 31 20 66 62 39 61 35 34 33 38 66 39 20 63 37 61 35 61 31 33 30 37 61 22 3e 3c 64 69 76 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 6f 69 6e 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 74 72 75 73 74 22 20 63 6c 61 73 73 3d 22 61 38 33 65 64 30 38 37 35 37 20 66 38 38 61 35 32 30 34 63 32 20 63 35 36 32 36 38 35 62 32 35 20 62 39 38 31 33 33 66 62 35 30 22 3e 3c 73 70 61 6e 3e 54 72 75 73 74 20 26 61 6d 70 3b 20 53 61 66 65 74 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 38 31 37 30 39 30 35 35 30 20 62 32 36 38 62 36 Data Ascii: 7fc01a42e"><li class="a8b57ad3ff d50c412d31 fb9a5438f9 c7a5a1307a"><div><a href="https://join.booking.com/trust" class="a83ed08757 f88a5204c2 c562685b25 b98133fb50"><span>Trust & Safety</span></a></div></li></ul></div><div class="b817090550 b268b6
2024-01-15 23:17:09 UTC	16330	IN	Data Raw: 69 5f 6c 70 5f 67 65 74 5f 73 74 61 72 74 65 64 22 3a 22 47 65 74 20 73 74 61 72 74 65 64 22 2c 22 62 68 5f 70 61 69 5f 6c 70 5f 6d 6f 62 69 6c 65 5f 63 6f 6e 74 69 6e 75 65 5f 72 65 67 22 3a 22 41 6c 72 65 61 64 79 20 73 74 61 72 74 65 64 20 72 65 67 69 73 74 72 61 74 69 6f 6e 3f 22 2c 22 62 68 5f 70 61 69 5f 6c 70 5f 74 61 62 5f 63 6f 6e 74 69 6e 75 65 5f 72 65 67 69 73 74 72 61 74 69 6f 6e 22 3a 22 43 6f 6e 74 69 6e 75 65 20 79 6f 75 72 20 72 65 67 69 73 74 72 61 74 69 6f 6e 22 2c 22 73 62 5f 6c 70 5f 74 61 62 5f 63 6f 6e 74 69 6e 75 65 5f 72 65 67 69 73 74 72 61 74 69 6f 6e 22 3a 22 43 6f 6e 74 69 6e 75 65 20 79 6f 75 72 20 72 65 67 69 73 74 72 61 74 69 6f 6e 22 2c 22 73 65 6c 66 5f 62 75 69 6c 64 5f 67 65 74 5f 73 74 61 72 74 65 64 22 3a 22 47 65 74 Data Ascii: i_lp_get_started":"Get started","bh_pai_lp_mobile_continue_reg":"Already started registration?","bh_pai_lp_tab_continue_registration":"Continue your registration","sb_lp_tab_continue_registration":"Continue your registration","self_build_get_started":"Get
2024-01-15 23:17:09 UTC	9957	IN	Data Raw: 32 36 64 64 0d 0a 70 4c 50 4c 61 6e 67 75 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 63 6f 64 65 22 3a 22 6e 6c 22 2c 22 61 63 74 69 76 65 22 3a 66 61 6c 73 65 2c 22 69 73 6f 43 6f 64 65 22 3a 6e 75 6c 6c 7d 2c 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4a 6f 69 6e 41 70 70 4c 50 4c 61 6e 67 75 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 4e 6f 72 73 6b 22 2c 22 63 6f 64 65 22 3a 22 6e 6f 22 2c 22 61 63 74 69 76 65 22 3a 66 61 6c 73 65 2c 22 69 73 6f 43 6f 64 65 22 3a 6e 75 6c 6c 7d 2c 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4a 6f 69 6e 41 70 70 4c 50 4c 61 6e 67 75 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 50 6f 6c 73 6b 69 22 2c 22 63 6f 64 65 22 3a 22 70 6c 22 2c 22 61 63 74 69 76 65 22 3a 66 61 6c 73 65 2c 22 69 73 6f Data Ascii: 26ddpLPLanguage","name":"Nederlands","code":"nl","active":false,"isoCode":null},{"__typename":"JoinAppLPLanguage","name":"Norsk","code":"no","active":false,"isoCode":null},{"__typename":"JoinAppLPLanguage","name":"Polski","code":"pl","active":false,"iso
2024-01-15 23:17:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.5	50640	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	643	OUT	GET /consent/04f32d9e-1729-4d42-82b5-91c2350ff323/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:09 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:08 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d49adb098226-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 28774 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:08 GMT Last-Modified: Wed, 06 Sep 2023 13:29:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 94DF/j88CBPf3yBQSh1qFA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a7f0fbf9-c01e-0030-47c6-e0874c000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:09 UTC	467	IN	Data Raw: 32 33 66 33 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 23f3{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 Data Ascii: kiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysAct
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 70 72 65 66 65 72 65 6e 63 65 73 22 2c 22 50 72 65 66 65 72 65 6e Data Ascii: ottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage cookie preferences","Preferen
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 67 65 2c 20 70 61 73 74 20 Data Ascii: al cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selected currency, language, past
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 Data Ascii: "Dropped by Security team as part of PerimeterX security services","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 22 3a 22 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4f 77 6e 65 64 20 62 79 20 6f 75 72 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 2e 20 55 73 65 64 20 66 6f 72 20 62 6f 74 20 64 65 74 65 63 74 69 6f 6e 20 76 69 61 20 61 6e 20 65 78 74 65 72 6e 61 6c 20 73 6f 75 72 63 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 2f 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a Data Ascii: ":"secure.booking.com","IsSession":false,"Length":"365","description":"Owned by our Security team. Used for bot detection via an external source: https://www.perimeterx.com/","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 74 6f 20 73 74 6f 72 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 20 74 6f 20 74 68 65 20 64 61 74 61 20 63 6f 6c 6c 65 63 74 69 6f 6e 20 50 75 72 70 6f 73 65 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 6f 6c 64 73 20 61 6e 20 65 6e 63 72 79 70 74 65 64 20 63 6f 6e 73 65 6e 74 20 73 74 72 69 6e 67 20 74 68 61 74 20 76 65 6e 64 6f 72 73 20 70 61 72 74 69 63 69 70 61 74 69 6e 67 20 69 6e 20 74 68 65 20 66 72 61 6d 65 77 6f 72 6b 20 63 61 6e 20 72 65 61 64 20 61 6e 64 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a Data Ascii: nt Framework to store the user's consent to the data collection Purposes. The cookie holds an encrypted consent string that vendors participating in the framework can read and determine the user's consent.","DurationType":1,"category":null,"isThirdParty":
2024-01-15 23:17:09 UTC	530	IN	Data Raw: 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 38 39 66 35 63 33 39 39 2d 61 31 64 37 2d 34 64 30 38 2d 61 64 63 30 2d 32 62 63 63 30 64 61 66 32 30 34 35 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 66 70 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 Data Ascii: ll,"thirdPartyKey":"","firstPartyKey":"","id":"89f5c399-a1d7-4d08-adc0-2bcc0daf2045","Name":"_pxff_fp","Host":"secure.booking.com","IsSession":false,"Length":"0","description":"Dropped by Security team as part of PerimeterX security services.","DurationTy
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 63 75 72 72 65 6e 74 20 73 65 73 73 69 6f 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 68 20 61 73 20 62 6f 6f 6b 69 6e 67 20 73 74 61 74 75 73 2c 20 68 6f 74 65 6c 20 62 65 69 6e 67 20 6c 6f 6f 6b 65 64 20 61 74 2c 20 6c 6f 63 61 6c 65 20 65 74 63 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 33 36 35 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 63 35 33 38 39 30 31 65 2d 62 37 38 36 Data Ascii: 7ffacurrent session information such as booking status, hotel being looked at, locale etc","DurationType":365,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":"","id":"c538901e-b786
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 47 65 6e 65 72 61 6c 20 70 75 72 70 6f 73 65 20 70 6c 61 74 66 6f 72 6d 20 73 65 73 73 69 6f 6e 20 63 6f 6f 6b 69 65 2c 20 75 73 65 64 20 62 79 20 73 69 74 65 73 20 77 72 69 74 74 65 6e 20 69 6e 20 4a 53 50 2e 20 55 73 75 61 6c 6c 79 20 75 73 65 64 20 74 6f 20 6d 61 69 6e 74 61 69 6e 20 61 6e 20 61 6e 6f 6e 79 6d 6f 75 73 20 75 73 65 72 20 73 65 73 73 69 6f 6e 20 62 79 20 74 68 65 20 73 65 72 76 65 72 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 Data Ascii: Type":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"General purpose platform session cookie, used by sites written in JSP. Usually used to maintain an anonymous user session by the server.","patternKey":null,"thirdPartyKey":null,"first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.5	50641	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:08 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.d2eb2267.us-east-1.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:08 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Mon, 15 Jan 2024 23:17:08 GMT X-Cache: Error from cloudfront Via: 1.1 749e1450fdc7cac18bb91a34e80053aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: TJYN6QCFhUG6VbFa6gy2CqebfQMlhwQmOWbzbY8qK6W7giXhJqzk9w==
2024-01-15 23:17:08 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.5	50642	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	2770	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _ga=GA1.1.810723182.1705360577; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; aws-waf-token=97fab002-645a-47f8-aa81-32c17b7a9b61:EQoAvVGiAg0qAAAA:IwqBOEvz3DZ3u4gNJhNYwwFayUsPLB6xUjfcVW0wgaBpqoNiXV/aQWhCYlaa68mOeEgGogS8OEIuuxTff9KSqXZmeErRWpHsCr84/RhxivFFJiop7YjwIDuUQvScYvLXCm7aAZJDWYg6lquQDEstdP/4TgVFyC6A6BqGyHML6qrVylu1k/3taIEkxoMUs7F4I+lP6krTW1sMBtVSONrKEb37exzTBvcBWJyKMaMNhDsp6SLB1hmVG1JwqN55VHXFE00oBskZ; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5th7exDV5qLlcnJvkDPQMAT%2B1DjwVO8s1W3Vh1YffglFV7hdrkLOf781qqr5y%2FqrFuxULU3MWxPLRP5twJnQl3jVZdiDH3W5cWlk%2BGCO7zKNpEVSfgnALbOwdcxhFrv34Kp2xyC1CTQ0bVsGL9yKfdOBMyPhJpMEi4%3D
2024-01-15 23:17:09 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:09 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=84c9a3baf81a01a1&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstq74RTWYQK-zPAAdf1IYdkq7L2Mw3sfik x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C1 X-Amz-Cf-Id: 7Jxl5PHCWuQz_D0gZU-kEdaKpeoOxk5BLCzc_oeIMmjh2ZQZBaU3OQ==
2024-01-15 23:17:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.5	50643	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	724	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 958 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYOZCLYDditAqLzzf72qwDBlw2D8SDlJlri0VNtfVqL7vqGNrB9oCJ+ys+vQ2cpUAAAAA=
2024-01-15 23:17:09 UTC	958	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 36 33 33 39 35 65 61 36 2d 33 37 34 39 2d 34 62 36 37 2d 38 38 33 62 2d 36 65 61 61 35 34 61 36 36 36 34 64 22 2c 22 6c 63 22 3a 22 33 64 35 36 31 61 64 61 2d 31 38 32 33 2d 34 61 62 36 2d 38 30 66 35 2d 35 37 61 32 66 32 30 63 63 61 35 62 22 2c 22 6c 73 22 3a 22 65 38 63 65 39 64 62 63 2d 37 65 36 37 2d 34 66 62 62 2d 62 38 32 64 2d 37 64 63 35 35 62 64 37 35 61 38 66 22 2c 22 72 22 3a 22 33 61 33 34 34 30 66 66 2d 62 64 38 32 2d 34 34 32 66 2d 62 33 66 64 2d 33 64 64 39 33 38 34 30 34 33 62 64 22 2c 22 73 73 22 3a 22 38 32 36 32 37 30 66 39 2d 36 32 66 65 2d 34 61 36 64 2d 62 65 31 36 2d 39 34 64 36 31 38 65 63 35 34 66 30 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"63395ea6-3749-4b67-883b-6eaa54a6664d","lc":"3d561ada-1823-4ab6-80f5-57a2f20cca5b","ls":"e8ce9dbc-7e67-4fbb-b82d-7dc55bd75a8f","r":"3a3440ff-bd82-442f-b3fd-3dd9384043bd","ss":"826270f9-62fe-4a6d-be16-94d618ec54f0","bg":true,"s
2024-01-15 23:17:09 UTC	523	IN	HTTP/1.1 200 OK date: Mon, 15 Jan 2024 23:17:09 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.5	50644	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	433	OUT	GET /consent/04f32d9e-1729-4d42-82b5-91c2350ff323/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:09 UTC	890	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:09 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d49dcc835ae0-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:09 GMT Last-Modified: Wed, 06 Sep 2023 13:29:51 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 94DF/j88CBPf3yBQSh1qFA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 853df318-701e-008c-3c45-23518d000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:09 UTC	479	IN	Data Raw: 37 63 32 38 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c28{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 6c Data Ascii: our Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Al
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 70 72 65 66 65 72 65 6e 63 65 73 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 6f 72 65 Data Ascii: erenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage cookie preferences","PreferenceCenterMore
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 67 65 2c 20 70 61 73 74 20 73 65 61 72 63 68 65 73 2c 20 61 6e Data Ascii: ust be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selected currency, language, past searches, an
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 76 69 Data Ascii: Security team as part of PerimeterX security services","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","Name":"_pxvi
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4f 77 6e 65 64 20 62 79 20 6f 75 72 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 2e 20 55 73 65 64 20 66 6f 72 20 62 6f 74 20 64 65 74 65 63 74 69 6f 6e 20 76 69 61 20 61 6e 20 65 78 74 65 72 6e 61 6c 20 73 6f 75 72 63 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 2f 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 Data Ascii: oking.com","IsSession":false,"Length":"365","description":"Owned by our Security team. Used for bot detection via an external source: https://www.perimeterx.com/","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patter
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 20 74 6f 20 73 74 6f 72 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 20 74 6f 20 74 68 65 20 64 61 74 61 20 63 6f 6c 6c 65 63 74 69 6f 6e 20 50 75 72 70 6f 73 65 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 6f 6c 64 73 20 61 6e 20 65 6e 63 72 79 70 74 65 64 20 63 6f 6e 73 65 6e 74 20 73 74 72 69 6e 67 20 74 68 61 74 20 76 65 6e 64 6f 72 73 20 70 61 72 74 69 63 69 70 61 74 69 6e 67 20 69 6e 20 74 68 65 20 66 72 61 6d 65 77 6f 72 6b 20 63 61 6e 20 72 65 61 64 20 61 6e 64 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 Data Ascii: to store the user's consent to the data collection Purposes. The cookie holds an encrypted consent string that vendors participating in the framework can read and determine the user's consent.","DurationType":1,"category":null,"isThirdParty":false},{"thi
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 38 39 66 35 63 33 39 39 2d 61 31 64 37 2d 34 64 30 38 2d 61 64 63 30 2d 32 62 63 63 30 64 61 66 32 30 34 35 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 66 70 22 2c 22 48 6f 73 74 22 3a 22 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 Data Ascii: tyKey":"","firstPartyKey":"","id":"89f5c399-a1d7-4d08-adc0-2bcc0daf2045","Name":"_pxff_fp","Host":"secure.booking.com","IsSession":false,"Length":"0","description":"Dropped by Security team as part of PerimeterX security services.","DurationType":1,"categ
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 30 22 2c 22 4e 61 6d 65 22 3a 22 41 57 53 41 4c 42 43 4f 52 53 22 2c 22 48 6f 73 74 22 3a 22 70 65 67 61 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 37 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 6d 61 6e 61 67 65 64 20 62 79 20 41 57 53 20 61 6e 64 20 69 73 20 75 73 65 64 20 66 6f 72 20 6c 6f 61 64 20 62 61 6c 61 6e 63 69 6e 67 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 57 53 20 45 4c 42 20 61 70 70 6c 69 63 61 74 Data Ascii: 0","Name":"AWSALBCORS","Host":"pega.booking.com","IsSession":false,"Length":"7","description":"This cookie is managed by AWS and is used for load balancing.","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":"AWS ELB applicat
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 69 64 22 3a 22 33 65 34 64 66 33 35 36 2d 34 31 35 64 2d 34 63 32 66 2d 62 37 34 62 2d 38 65 61 35 33 63 66 36 64 36 39 32 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 66 70 22 2c 22 48 6f 73 74 22 3a 22 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 Data Ascii: PartyKey":"","id":"3e4df356-415d-4c2f-b74b-8ea53cf6d692","Name":"_pxff_fp","Host":"cf.bstatic.com","IsSession":false,"Length":"0","description":"Dropped by Security team as part of PerimeterX security services.","DurationType":1,"category":null,"isThirdPa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.5	50645	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	603	OUT	GET /scripttemplates/202308.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:09 UTC	826	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:09 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Wed, 25 Oct 2023 03:55:54 GMT ETag: 0x8DBD50E49DDD45B x-ms-request-id: 72fd04b3-201e-0091-789e-0b5c31000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 20424 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d49deaef829f-IAD
2024-01-15 23:17:09 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ic
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f Data Ascii: ync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#o
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 Data Ascii: ackground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scr
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 Data Ascii: netrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inp
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 Data Ascii: ay:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c Data Ascii: #onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 Data Ascii: sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c Data Ascii: er-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,
2024-01-15 23:17:09 UTC	1369	IN	Data Raw: 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 Data Ascii: k-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.5	50647	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	576	OUT	GET /consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:10 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d4a19af607a8-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 86280 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:10 GMT Last-Modified: Thu, 31 Aug 2023 13:58:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: beQdap77rwnPIOfv0zpHDQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d54d9a85-a01e-00a0-1262-14bd22000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:10 UTC	467	IN	Data Raw: 31 37 63 32 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 17c2!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 3d 3d 3d 68 7d 29 26 26 28 67 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 67 7d 28 61 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 63 2c 76 73 43 61 74 49 64 73 3a 62 7d 7d 66 75 6e 63 74 69 6f Data Ascii: =function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}functio
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 73 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 74 65 78 74 2f 70 6c 61 69 6e 22 3d 3d 3d 0a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 2e 72 65 6d 6f 76 Data Ascii: src\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexecute",c=function(e){"text/plain"===a.getAttribute("type")&&e.preventDefault();a.remov
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 2f 73 69 67 6e 61 6c 73 2f 63 6f 6e 66 69 67 2f 31 33 34 38 37 34 34 34 30 35 31 38 33 36 31 31 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 70 73 62 2f 6a 6f 69 6e 61 70 70 2f 61 73 73 65 74 73 2f 62 75 69 6c 64 2f 73 65 6f 2e 64 33 62 61 63 34 34 32 34 32 35 31 33 37 66 62 36 66 38 38 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f Data Ascii: r":null},{"Tag":"https://connect.facebook.net/signals/config/1348744405183611","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://cf.bstatic.com/psb/joinapp/assets/build/seo.d3bac442425137fb6f88.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https:/
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 7b 63 68 69 6c 64 4c 69 73 74 3a 21 30 2c 73 75 62 74 72 65 65 3a 21 30 2c 61 74 74 72 69 62 75 74 65 73 3a 21 30 2c 0a 61 74 74 72 69 62 75 74 65 46 69 6c 74 65 72 3a 5b 22 73 72 63 22 5d 7d 29 2c 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 61 2c 63 2c 62 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 62 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 72 65 74 75 72 6e 22 73 63 72 69 70 74 22 3d 3d 3d 62 5b 30 5d 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 2d 31 21 3d 3d 74 2e Data Ascii: document.documentElement,{childList:!0,subtree:!0,attributes:!0,attributeFilter:["src"]}),document.createElement);document.createElement=function(){for(var a,c,b=[],e=0;e<arguments.length;e++)b[e]=arguments[e];return"script"===b[0].toLowerCase()\|\|-1!==t.
2024-01-15 23:17:10 UTC	147	IN	Data Raw: 73 2c 66 2c 64 2e 76 73 43 61 74 49 64 73 29 29 2c 21 30 3b 76 61 72 20 67 2c 68 2c 64 7d 7d 7d 29 2c 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 67 2c 68 29 7b 22 74 79 70 65 22 21 3d 3d 66 26 26 22 73 72 63 22 21 3d 3d 66 7c 7c 68 3f 63 28 66 2c 67 29 3a 61 5b 66 5d 3d 67 7d 2c 61 29 3a 42 2e 62 69 6e 64 28 64 6f 63 75 6d 65 6e 74 29 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 62 29 7d 7d 28 29 3b 0d 0a Data Ascii: s,f,d.vsCatIds)),!0;var g,h,d}}}),a.setAttribute=function(f,g,h){"type"!==f&&"src"!==f\|\|h?c(f,g):a[f]=g},a):B.bind(document).apply(void 0,b)}}();
2024-01-15 23:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.5	50648	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	393	OUT	GET /scripttemplates/202308.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	826	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:10 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Wed, 25 Oct 2023 03:55:54 GMT ETag: 0x8DBD50E49DDD45B x-ms-request-id: f042c46f-001e-004d-6e9e-0bf66f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 53977 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8461d4a1abc03b06-IAD
2024-01-15 23:17:10 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ic
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f Data Ascii: ync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#o
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 Data Ascii: ackground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scr
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 Data Ascii: netrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inp
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 Data Ascii: ay:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c Data Ascii: #onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 Data Ascii: sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c Data Ascii: er-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,
2024-01-15 23:17:10 UTC	1369	IN	Data Raw: 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 Data Ascii: k-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.5	50650	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	576	OUT	GET /psb/capla/static/css/c8a2f0e8.f2766d1b.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	608	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1256 Connection: close Date: Mon, 15 Jan 2024 23:17:11 GMT Last-Modified: Mon, 15 Jan 2024 14:48:43 GMT ETag: "6639902487d627277b42c8a94c99c87c" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BZ0osvjsmUFfzs2ujj14DAEjEHe7lR9B Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: Q6O4QMyr9RjFgkYi8AItflO3baqanCbhxrnyxfsJW7lCnXGjvbZR6g== Vary: Origin
2024-01-15 23:17:10 UTC	1256	IN	Data Raw: 2e 65 34 39 63 31 32 36 31 39 65 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 35 34 30 70 78 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 38 30 70 78 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 37 32 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 36 32 36 63 61 30 66 30 30 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 32 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d Data Ascii: .e49c12619e{min-height:540px;height:calc(100vh - 80px);display:flex;flex-direction:column;justify-content:center;width:720px;margin:0 auto;text-align:center}.c626ca0f00{font-size:48px;font-weight:700;line-height:62px;font-family:BlinkMacSystemFont,-apple-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.5	50653	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	576	OUT	GET /psb/capla/static/css/4ff72d09.17169d33.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	609	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 28351 Connection: close Date: Mon, 15 Jan 2024 23:17:11 GMT Last-Modified: Mon, 15 Jan 2024 14:48:43 GMT ETag: "045d81f301b4b2739996e7ff2370a865" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 0OpaH27VPC47WmXaC5ksXpA6_bTx.C0w Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 62997e8047323290451b8a864e88914c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: RBOeeOixqQyeHU0cS_sKBsqmjzW4U-a_wlzpDwnbv4xipAfvZbwgEQ== Vary: Origin
2024-01-15 23:17:10 UTC	15775	IN	Data Raw: 2e 66 38 62 64 65 38 34 32 31 31 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 63 6f 6c 6f 72 28 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 29 20 6c 28 37 35 25 29 29 7d 2e 61 35 39 36 64 31 66 66 66 65 3a 68 6f 76 65 72 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 e2 86 92 22 3b 70 6f 73 69 74 69 6f Data Ascii: .f8bde84211{padding:var(--bui_spacing_2x) var(--bui_spacing_4x);border-radius:var(--bui_spacing_half);font-size:14px;line-height:20px;display:inline-block;border:1px solid color(var(--bui_color_border) l(75%))}.a596d1fffe:hover:after{content:"";positio
2024-01-15 23:17:10 UTC	215	IN	Data Raw: 69 6e 67 2d 72 69 67 68 74 3a 36 30 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 72 74 6c 20 2e 63 30 64 30 65 34 34 38 61 38 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 63 30 64 30 65 34 34 38 61 38 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 30 70 78 7d 2e 66 33 33 66 33 32 64 63 66 33 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 61 62 33 30 37 33 32 37 66 63 7b 7a 2d 69 6e 64 65 78 3a 33 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d Data Ascii: ing-right:60px;vertical-align:middle}.rtl .c0d0e448a8,[dir=rtl] .c0d0e448a8{padding-right:0;padding-left:60px}.f33f32dcf3{display:table-cell;vertical-align:middle}.ab307327fc{z-index:3;position:relative}@media (max-
2024-01-15 23:17:10 UTC	1418	IN	Data Raw: 77 69 64 74 68 3a 39 39 32 70 78 29 7b 2e 63 32 37 37 65 61 62 36 62 66 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 63 30 64 30 65 34 34 38 61 38 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 72 74 6c 20 2e 63 30 64 30 65 34 34 38 61 38 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 63 30 64 30 65 34 34 38 61 38 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 7d 2e 66 33 33 66 33 32 64 63 66 33 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 2e 62 65 35 34 66 37 65 34 39 31 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 64 61 65 64 65 66 39 33 35 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 6c 69 6e 65 2d 68 65 Data Ascii: width:992px){.c277eab6bf{display:block}.c0d0e448a8{display:block;padding-right:0;text-align:center}.rtl .c0d0e448a8,[dir=rtl] .c0d0e448a8{padding-left:0}.f33f32dcf3{display:block}}.be54f7e491{color:var(--bui_color_white)}.daedef9356{font-size:32px;line-he
2024-01-15 23:17:10 UTC	10943	IN	Data Raw: 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 6c 65 66 74 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 3a 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6c 61 63 6b 29 7d 2e 61 64 39 65 39 35 61 65 36 34 20 2e 63 32 65 36 37 66 64 30 35 64 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 68 74 74 70 73 3a 2f 2f 71 Data Ascii: --bui_color_white);padding:var(--bui_spacing_2x) var(--bui_spacing_4x) var(--bui_spacing_2x) var(--bui_spacing_6x);text-align:left;justify-content:left;width:100%;border:0;color:var(--bui_color_black)}.ad9e95ae64 .c2e67fd05d:hover{background:url(https://q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.5	50649	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	669	OUT	GET /psb/capla/static/css/client.c9e8f1b3.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "65adf2d4363bba13d63bbc403b0b3cce" If-Modified-Since: Mon, 15 Jan 2024 13:45:30 GMT
2024-01-15 23:17:10 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Mon, 15 Jan 2024 23:17:10 GMT ETag: "65adf2d4363bba13d63bbc403b0b3cce" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: u3cn6Ed7thVPXGQQa79hHShJJmXcB4zJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5451b84324d9bca0bdd03e4c4009ae10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: kbCYlHjWXqPdGk1jmAP_K-QdVJuVDUkOr8LEqIgBpferIIrXtL5kyQ== Age: 34300 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.5	50654	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:09 UTC	560	OUT	GET /psb/capla/static/js/697d5684.349d4aeb.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	632	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 387 Connection: close Last-Modified: Thu, 11 Jan 2024 16:04:46 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: zcHZfad9Bg4tiqvxcm43vX6BSKJw_iqG Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 18:04:34 GMT ETag: "c597a946df70af95f9f6ff69f1811664" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: VPI_7_-bvEhOhtbIO1PzcKM2yTUlspDj8lN3ipKoqQFjRjJn33tK2g== Age: 18757 Vary: Origin
2024-01-15 23:17:10 UTC	387	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 39 37 64 35 36 38 34 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 70 2c 5f 2c 65 29 7b 65 2e 72 28 5f 29 3b 76 61 72 20 61 3d 65 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 61 2e 73 65 72 76 65 29 28 28 28 29 3d 3e 65 2e 65 28 22 63 38 61 32 66 30 65 38 22 29 2e 74 68 65 6e 28 65 2e 62 69 6e 64 28 65 Data Ascii: "use strict";(self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["697d5684"],{fe905f7b:function(p,_,e){e.r(_);var a=e("540adcd8");(0,a.serve)((()=>e.e("c8a2f0e8").then(e.bind(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.5	50656	18.173.219.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:10 UTC	4511	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ref_action=help&pid=6880a3b6d76d00c5&stype=1&lang=en-us&ver=2&aid=304142&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|4084&m=UmFuZG9tSVYkc2RlIyh9YQNcFzDQ3JSun3Qy_smY43fuAGTvBgN4LflpwzIpPoohGF1CCvVXxBSRJQVJkag9AWYU9VfB6XJIhFThxH05tfoh6d2GnOkM0ZpWMpsPDKUWilnyz9TkVxfBDmQCPKQSAelf1mz3MHclSYpvvT3Ovek06EVbxX_UPGBogVHnUgXkwn6XQvuSA7rH2ZyFdgaSDTK0gBRDXJ3h2JK0VOSUMpq0QCCSU5Ompw HTTP/1.1 Host: secure.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: X-Booking-CSRF: LvWlZQAAAAA=hrh3k6yYtgWUB48-Rr6XI7bYwrUM7JC8RA1RZcRh2fm2gndNvZY1g4XzW2dJ3yyWqULwErBR6Av_lq50kJNmHIrfOZJdmNz5KgItJNEzRc_QREUq9wqdDX3n1TCiWI0FKq006-B-42tFa46MmffSgM1f485f1qBllDxgjVGwyE_sPbkIIDFF2a9zcXa-D8jUAsFdBknNSBgCOw6T sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 6880a3b6d76d00c5 X-Booking-Info: HMbIWWPaDMRJLYZET\|1,HMbIKELcdEZYHRYKe\|1,HMbBaSFbeAFDCaceNTWYcMSPRXe\|4,HMbBaSFbeAFDCaceNTWYcMSPRXe\|8,HMbBaSFbeAFDCaceNTWYcMSPRXe\|6,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,HMbBVbXbTYJKSCHe\|1,HMbBVbXbTYJKSCHe\|2 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 0059242d4bafbe759210d4ea3ea582cb sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; PegaIAC=IACtest; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1705360627956; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A17%3A09+GMT%2B0100+(Central+European+Standard+Time)&version=202308.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D
2024-01-15 23:17:10 UTC	508	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:10 GMT vary: Accept-Encoding vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 782a6f1057a52009822f51ac887d693e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: kkRMfM1VIiqWr-RRn2QNsKcoF0yjUALVRHoTvXgJEhD3kLWbV-2_1Q==
2024-01-15 23:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.5	50655	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:10 UTC	556	OUT	OPTIONS /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-api-version Origin: https://secure.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	806	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 13 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:10 GMT vary: Origin access-control-allow-origin: https://secure.booking.com access-control-allow-credentials: true access-control-max-age: 1800 access-control-allow-methods: GET,POST access-control-allow-headers: Accept,Accept-Encoding,Accept-Language,Connection,Content-Length,Content-Type,Host,Origin,Referer,User-Agent,X-Booking-API-Version,X-Booking-CSRF allow: POST,OPTIONS strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b140d5b0fbed1dab248b0959f44a7944.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: Z5kEfSFj60klDxiUZGJeyi5TF2UOP0mZlIZvguwGMPx-jdehMpBQXg==
2024-01-15 23:17:10 UTC	13	IN	Data Raw: 50 4f 53 54 2c 20 4f 50 54 49 4f 4e 53 Data Ascii: POST, OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.5	50658	3.162.103.9	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:10 UTC	656	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secure.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secure.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:10 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 36 38 38 30 61 33 62 36 64 37 36 64 30 30 63 35 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 68 65 6c 70 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 34 30 38 34 2e 38 30 30 30 30 30 30 30 30 30 31 37 35 7d Data Ascii: {"pid":"6880a3b6d76d00c5","refAction":"help","siteType":"1","lcp":4084.8000000000175}
2024-01-15 23:17:10 UTC	528	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:10 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://secure.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2c36186b512068f67b05531ba050ed00.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: ef4-TdmBNsB1SHjUNAZcxa53WLQA2oS9kP0B_R3Z7bwnNlXb_cG0-A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.5	50651	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	552	OUT	GET /psb/capla/static/js/client.7ef6b36a.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:11 UTC	636	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1017227 Connection: close Last-Modified: Wed, 03 Jan 2024 12:28:45 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: v1XeSlOLiCJ_xmnZZT.uvaniqT5207Qp Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 13:07:52 GMT ETag: "779ae6a8726ad43c905ce5a4dc1ecdf7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 77dc0904034d14a129bafe4c9d954f08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: M9M5npC2XNzhWua5WeYpVOEQLVFov26cAfPWt_SLH3wy-PnSfX2BqA== Age: 36560 Vary: Origin
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 37 65 66 36 62 33 36 61 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.7ef6b36a.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 64 65 72 73 29 28 6f 29 2c 54 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 2c 74 26 26 74 2e 72 65 6c 65 61 73 65 28 29 2c 65 3d 6e 75 6c 6c 2c 74 3d 6e 75 6c 6c 3b 76 61 72 20 6c 3d 68 3f 6e 2e 72 65 6d 6f 76 65 54 69 6c 6c 28 68 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6f 6e 74 61 69 6e 73 28 65 2e 74 72 69 67 67 65 72 45 6c 29 7d 29 29 3a 76 6f 69 64 20 30 2c 66 3d 28 6e 75 6c 6c 3d 3d 3d 6c 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6c 3f 76 6f 69 64 20 30 3a 6c 2e 70 72 65 76 49 64 29 26 26 28 6e 75 6c 6c 3d 3d 3d 28 61 3d 6e 2e 67 65 74 28 6c 2e 70 72 65 76 49 64 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 72 6f 6f 74 45 6c 29 3b 66 26 26 70 28 66 2c 7b 72 65 6c 65 61 73 Data Ascii: ders)(o),T.disconnect(),t&&t.release(),e=null,t=null;var l=h?n.removeTill(h,(function(e){return document.body.contains(e.triggerEl)})):void 0,f=(null===l\|\|void 0===l?void 0:l.prevId)&&(null===(a=n.get(l.prevId))\|\|void 0===a?void 0:a.rootEl);f&&p(f,{releas
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 69 6f 6e 3d 74 2e 67 65 74 49 6e 42 6f 75 6e 64 73 50 6f 73 69 74 69 6f 6e 3d 76 6f 69 64 20 30 3b 76 61 72 20 6f 3d 6e 28 22 30 65 33 66 65 33 66 63 22 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 67 65 74 49 6e 42 6f 75 6e 64 73 50 6f 73 69 74 69 6f 6e 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 28 6f 29 2e 64 65 66 61 75 6c 74 7d 7d 29 3b 76 61 72 20 61 3d 6e 28 22 35 31 39 61 37 32 64 62 22 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 67 65 74 50 6f 73 69 74 69 6f 6e 43 6f 6d 70 65 6e 73 61 74 69 6f 6e 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 Data Ascii: ion=t.getInBoundsPosition=void 0;var o=n("0e3fe3fc");Object.defineProperty(t,"getInBoundsPosition",{enumerable:!0,get:function(){return r(o).default}});var a=n("519a72db");Object.defineProperty(t,"getPositionCompensation",{enumerable:!0,get:function(){ret
2024-01-15 23:17:11 UTC	14808	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 78 63 7d 2c 53 63 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 74 7d 2c 53 65 67 6d 65 6e 74 65 64 43 6f 6e 74 72 6f 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 63 7d 2c 53 68 65 65 74 43 6f 6e 74 61 69 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 63 7d 2c 53 6b 65 6c 65 74 6f 6e 4c 6f 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 74 7d 2c 53 6c 69 64 65 72 43 6f 6e 74 61 69 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 73 7d 2c 53 70 69 6e 6e 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 56 7d 2c 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b Data Ascii: function(){return xc},Scrim:function(){return et},SegmentedControl:function(){return Uc},SheetContainer:function(){return Yc},SkeletonLoader:function(){return Kt},SliderContainer:function(){return Os},Spinner:function(){return V},Stack:function(){return K
2024-01-15 23:17:11 UTC	370	IN	Data Raw: 6e 2d 72 6f 77 22 3a 22 63 32 39 33 31 66 34 31 38 32 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 72 65 76 65 72 73 65 22 3a 22 65 31 66 66 61 63 34 65 34 31 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 6f 6c 75 6d 6e 2d 2d 6d 22 3a 22 61 36 65 33 30 37 62 61 34 36 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 2d 2d 6d 22 3a 22 62 38 64 37 33 65 61 37 32 36 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 2d 6d 22 3a 22 64 38 62 65 63 37 37 39 38 62 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 72 65 76 65 72 73 65 2d 2d 6d 22 3a 22 66 33 37 35 39 62 33 33 32 62 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 Data Ascii: n-row":"c2931f4182","root--direction-row-reverse":"e1ffac4e41","root--direction-column--m":"a6e307ba46","root--direction-column-reverse--m":"b8d73ea726","root--direction-row--m":"d8bec7798b","root--direction-row-reverse--m":"f3759b332b","root--direction-c
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 72 65 76 65 72 73 65 2d 2d 6c 22 3a 22 66 32 63 65 38 31 65 32 65 65 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 6f 6c 75 6d 6e 2d 2d 78 6c 22 3a 22 65 61 63 35 61 66 31 61 64 35 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 2d 2d 78 6c 22 3a 22 62 34 36 33 61 64 33 61 36 39 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 2d 78 6c 22 3a 22 64 33 35 63 64 35 38 62 32 63 22 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 72 65 76 65 72 73 65 2d 2d 78 6c 22 3a 22 65 33 36 66 33 61 32 34 39 39 22 2c 22 72 6f 6f 74 2d 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 73 74 61 72 74 22 3a 22 63 64 30 30 39 31 63 61 64 Data Ascii: --direction-row-reverse--l":"f2ce81e2ee","root--direction-column--xl":"eac5af1ad5","root--direction-column-reverse--xl":"b463ad3a69","root--direction-row--xl":"d35cd58b2c","root--direction-row-reverse--xl":"e36f3a2499","root--align-items-start":"cd0091cad
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 34 32 63 22 2c 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 61 6c 74 22 3a 22 66 65 30 61 62 38 39 30 30 34 22 2c 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 63 61 6c 6c 6f 75 74 5f 61 6c 74 22 3a 22 61 65 30 32 39 63 66 31 30 30 22 2c 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 5f 61 6c 74 22 3a 22 66 35 62 65 30 38 62 62 65 32 22 2c 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 61 63 74 69 6f 6e 5f 61 6c 74 22 3a 22 61 39 33 65 30 65 35 34 65 38 22 2c 22 72 6f 6f 74 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 5f 61 6c 74 22 3a 22 62 65 64 37 34 35 65 33 35 Data Ascii: 42c","root--background-color-constructive_alt":"fe0ab89004","root--background-color-callout_alt":"ae029cf100","root--background-color-accent_alt":"f5be08bbe2","root--background-color-action_alt":"a93e0e54e8","root--background-color-neutral_alt":"bed745e35
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 2e 30 32 34 32 33 20 35 2e 36 30 37 37 31 43 38 2e 30 32 34 32 33 20 35 2e 37 32 37 33 39 20 38 2e 30 34 38 31 39 20 35 2e 38 34 35 38 36 20 38 2e 30 39 34 37 31 20 35 2e 39 35 36 31 33 43 38 2e 31 34 31 32 32 20 36 2e 30 36 36 34 20 38 2e 32 30 39 33 35 20 36 2e 31 36 36 32 34 20 38 2e 32 39 35 30 36 20 36 2e 32 34 39 37 36 4c 31 33 2e 39 38 38 37 20 31 31 2e 39 36 37 36 4c 38 2e 32 37 30 38 34 20 31 37 2e 36 38 35 35 43 38 2e 31 38 35 31 32 20 31 37 2e 37 36 39 20 38 2e 31 31 37 20 31 37 2e 38 36 38 39 20 38 2e 30 37 30 34 38 20 31 37 2e 39 37 39 32 43 38 2e 30 32 33 39 36 20 31 38 2e 30 38 39 34 20 38 20 31 38 2e 32 30 37 39 20 38 20 31 38 2e 33 32 37 36 43 38 20 31 38 2e 34 34 37 33 20 38 2e 30 32 33 39 36 20 31 38 2e 35 36 35 37 20 38 2e 30 37 30 34 Data Ascii: .02423 5.60771C8.02423 5.72739 8.04819 5.84586 8.09471 5.95613C8.14122 6.0664 8.20935 6.16624 8.29506 6.24976L13.9887 11.9676L8.27084 17.6855C8.18512 17.769 8.117 17.8689 8.07048 17.9792C8.02396 18.0894 8 18.2079 8 18.3276C8 18.4473 8.02396 18.5657 8.0704
2024-01-15 23:17:11 UTC	14808	IN	Data Raw: 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 6c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 66 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 64 65 66 61 75 6c 74 53 74 61 72 74 44 61 74 65 2c 6e 3d 65 2e 64 65 66 61 75 6c 74 45 6e 64 44 61 74 65 2c 72 3d 65 2e 6f 6e 44 61 74 65 43 68 61 6e 67 65 2c 61 3d 6f 28 29 2e 75 73 65 53 74 61 74 65 28 74 7c 7c 6e 75 6c 6c 29 2c 69 3d 61 5b 30 5d 2c 73 3d 61 5b 31 5d 2c 63 3d 6f 28 29 2e 75 73 65 53 74 61 74 65 28 6e 7c 7c 6e 75 6c 6c 29 2c 75 3d 63 5b 30 5d 2c 6c 3d 63 5b 31 5d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 75 6e 2c 6c 6e 28 Data Ascii: sOwnProperty.call(t,o)&&(e[o]=t[o]);return e},ln.apply(this,arguments)},fn=function(e){var t=e.defaultStartDate,n=e.defaultEndDate,r=e.onDateChange,a=o().useState(t\|\|null),i=a[0],s=a[1],c=o().useState(n\|\|null),u=c[0],l=c[1];return o().createElement(un,ln(
2024-01-15 23:17:11 UTC	1576	IN	Data Raw: 22 63 61 37 38 32 33 66 62 64 34 22 7d 2c 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 72 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 61 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 69 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 66 72 6f 6d 2c 6e 3d Data Ascii: "ca7823fbd4"},ar=function(){return ar=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},ar.apply(this,arguments)},ir=function(e){var t=e.from,n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.5	50652	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	560	OUT	GET /psb/capla/static/js/c8a2f0e8.8981d2dc.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:11 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 20557 Connection: close Date: Mon, 15 Jan 2024 18:04:34 GMT Last-Modified: Mon, 15 Jan 2024 14:48:43 GMT ETag: "bf1f8432ba23d6d7de73ed81680b3619" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Dd2l_2WLJ0Ty794DxAfzf3q_TsM6u1Fy Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: VOx758khKj8_Y2Wouhn7uV3eie5jvfrpUnkihEXyH592zIS_b-fSFw== Age: 18758 Vary: Origin
2024-01-15 23:17:11 UTC	15750	IN	Data Raw: 28 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 38 61 32 66 30 65 38 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 22 36 65 65 38 38 63 35 34 22 29 2c 6f 3d 6e 28 22 64 63 36 64 32 38 66 66 22 29 2c 69 3d 6e Data Ascii: (self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c8a2f0e8"],{"181eacc8":function(e,t,n){"use strict";n.d(t,{d:function(){return a}});var r=n("6ee88c54"),o=n("dc6d28ff"),i=n
2024-01-15 23:17:11 UTC	4807	IN	Data Raw: 65 29 3b 76 61 72 20 65 7d 2c 6e 7d 28 6f 2e 43 6f 6d 70 6f 6e 65 6e 74 29 3b 72 65 74 75 72 6e 20 75 2e 63 6f 6e 74 65 78 74 54 79 70 65 73 3d 28 28 69 3d 7b 7d 29 5b 61 5d 3d 73 28 29 2e 6f 62 6a 65 63 74 2c 69 29 2c 7b 50 72 6f 76 69 64 65 72 3a 63 2c 43 6f 6e 73 75 6d 65 72 3a 75 7d 7d 2c 62 3d 67 2c 78 3d 21 30 2c 45 3d 22 49 6e 76 61 72 69 61 6e 74 20 66 61 69 6c 65 64 22 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 29 7b 69 66 28 78 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 45 29 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 45 2b 22 3a 20 22 2b 28 74 7c 7c 22 22 29 29 7d 7d 2c 77 3d 6e 28 22 65 36 33 65 32 32 32 33 22 29 2c 5f 3d 6e 2e 6e 28 77 29 2c 43 3d 28 6e 28 22 31 30 64 62 33 66 39 64 22 29 2c Data Ascii: e);var e},n}(o.Component);return u.contextTypes=((i={})[a]=s().object,i),{Provider:c,Consumer:u}},b=g,x=!0,E="Invariant failed";var A=function(e,t){if(!e){if(x)throw new Error(E);throw new Error(E+": "+(t\|\|""))}},w=n("e63e2223"),_=n.n(w),C=(n("10db3f9d"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.5	50659	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	560	OUT	GET /psb/capla/static/js/4ff72d09.d3848f83.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:11 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 229775 Connection: close Date: Mon, 15 Jan 2024 21:58:27 GMT Last-Modified: Fri, 12 Jan 2024 05:19:14 GMT ETag: "4656ace9012fa3b7a4cf9353f780165e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: bpopzLAia29AToNidW7QgAXPXM2tOBNl Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 cdb7a265f783ce0c07661e9c6820c2c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: PH6QZQMuveoslWijvEoD17iBMXCTK2d79lKhYY2C-HUmvS8vmkKq2A== Age: 4725 Vary: Origin
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 66 66 37 32 64 30 39 2e 64 33 38 34 38 66 38 33 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6a 6f 69 6e 61 70 70 6c 70 2d 6a 6f 69 6e 61 70 70 6c 70 2d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 66 66 37 32 64 30 39 22 2c 22 35 35 32 36 62 38 32 38 22 2c 22 31 38 35 33 34 65 33 30 22 5d 2c 7b 22 36 31 32 32 37 66 30 Data Ascii: /! For license information please see 4ff72d09.d3848f83.chunk.js.LICENSE.txt /(self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]=self["b-joinapplp-joinapplp-fe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4ff72d09","5526b828","18534e30"],{"61227f0
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 47 2c 6e 75 6c 6c 29 29 29 29 29 7d 7d 2c 22 37 34 37 61 32 63 66 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 49 47 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 59 71 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 70 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 76 61 72 20 61 3d 6e 28 22 64 31 65 35 34 61 39 36 22 29 3b 63 6f 6e 73 74 20 72 3d 28 29 3d 3e 28 30 2c 61 2e 63 6f 6e 73 74 72 75 63 74 55 72 6c 29 28 7b 70 61 74 68 6e 61 6d 65 3a 22 2f 6a 73 6f 6e 2f 69 6e 64 65 78 2e 6a 73 6f 6e 22 7d 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 61 73 79 6e 63 20 66 75 6e 63 Data Ascii: ().createElement(G,null)))))}},"747a2cf1":function(e,t,n){"use strict";n.d(t,{IG:function(){return l},Yq:function(){return i},p_:function(){return o}});var a=n("d1e54a96");const r=()=>(0,a.constructUrl)({pathname:"/json/index.json"}).toString();async func
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 28 61 7c 7c 28 61 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4c 4f 47 4f 5f 43 4c 49 43 4b 45 44 3d 22 6c 6f 67 6f 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 53 4f 43 49 41 4c 5f 45 4e 54 52 59 5f 43 4c 49 43 4b 45 44 3d 22 73 6f 63 69 61 6c 2d 65 6e 74 72 79 70 6f 69 6e 74 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 48 45 4c 50 5f 43 45 4e 54 45 52 5f 43 4c 49 43 4b 45 44 3d 22 68 65 6c 70 2d 63 65 6e 74 65 72 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 4c 49 53 54 5f 50 52 4f 50 45 52 54 59 5f 43 4c 49 43 4b 45 44 3d 22 6c 69 73 74 2d 70 72 6f 70 65 72 74 79 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 53 49 47 4e 5f 55 50 5f 43 4c 49 43 4b 45 44 3d 22 73 69 67 6e 2d 75 70 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 53 49 47 4e 5f 49 4e 5f 43 4c 49 43 4b 45 44 3d 22 73 69 67 Data Ascii: (a\|\|(a={})),function(e){e.LOGO_CLICKED="logo_clicked",e.SOCIAL_ENTRY_CLICKED="social-entrypoint_clicked",e.HELP_CENTER_CLICKED="help-center_clicked",e.LIST_PROPERTY_CLICKED="list-property_clicked",e.SIGN_UP_CLICKED="sign-up_clicked",e.SIGN_IN_CLICKED="sig
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 65 6c 65 63 74 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 4f 2e 64 72 6f 70 64 6f 77 6e 5f 73 65 6c 65 63 74 2c 6e 61 6d 65 3a 22 6c 61 6e 67 22 2c 76 61 6c 75 65 3a 6e 75 6c 6c 3d 3d 3d 61 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 63 6f 64 65 2c 6f 6e 43 68 61 6e 67 65 3a 74 3d 3e 7b 63 6f 6e 73 74 20 6e 3d 74 2e 63 75 72 72 65 6e 74 54 61 72 67 65 74 2e 76 61 6c 75 65 3b 65 2e 6f 6e 43 68 61 6e 67 65 28 74 2c 6e 29 7d 2c 6f 6e 42 6c 75 72 3a 72 7d 2c 65 2e 70 6f 70 75 6c 61 72 2e 6c 65 6e 67 74 68 3e 30 26 26 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 67 72 6f 75 70 22 2c 7b 6b 65 79 3a 22 70 6f 70 75 6c 61 72 22 2c 6c 61 62 65 6c 3a 74 2e 74 72 61 6e 73 28 28 30 2c 5a 2e 74 29 28 22 62 68 5f 6c 70 5f 6d 6f 73 Data Ascii: elect",{className:O.dropdown_select,name:"lang",value:null===a\|\|void 0===a?void 0:a.code,onChange:t=>{const n=t.currentTarget.value;e.onChange(t,n)},onBlur:r},e.popular.length>0&&o().createElement("optgroup",{key:"popular",label:t.trans((0,Z.t)("bh_lp_mos
2024-01-15 23:17:11 UTC	15283	IN	Data Raw: 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6a 6f 69 6e 61 70 70 49 6e 64 65 78 55 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 61 62 73 6f 6c 75 74 65 49 6e 64 65 78 55 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 61 6e 6f 6e 69 63 61 6c 55 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 Data Ascii: tives:[]},{kind:"Field",name:{kind:"Name",value:"joinappIndexUrl"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"absoluteIndexUrl"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"canonicalUrl"},arguments:[],directi
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 65 6d 65 6e 74 28 63 2e 4c 69 6e 6b 2c 7b 68 72 65 66 3a 65 2e 74 65 72 6d 73 55 72 6c 2c 63 6c 61 73 73 4e 61 6d 65 3a 73 28 29 28 22 61 75 74 6f 6d 61 74 69 6f 6e 5f 74 65 72 6d 73 5f 6c 69 6e 6b 22 2c 70 2e 74 65 72 6d 73 55 72 6c 29 2c 74 65 78 74 3a 74 2e 74 72 61 6e 73 28 28 30 2c 64 2e 74 29 28 22 72 61 66 5f 74 65 72 6d 73 5f 61 6e 64 5f 63 6f 6e 64 69 74 69 6f 6e 73 5f 6c 69 6e 6b 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 73 74 61 72 74 5f 6c 69 6e 6b 3a 22 22 2c 65 6e 64 5f 6c 69 6e 6b 3a 22 22 7d 7d 29 29 7d 29 29 7d 76 61 72 20 4e 3d 6e 28 22 31 35 33 64 36 66 36 35 22 29 2c 54 3d 6e 28 22 35 38 62 34 32 62 37 64 22 29 2c 78 3d 6e 28 22 34 33 62 65 64 64 38 34 22 29 3b 66 75 6e 63 74 69 6f 6e 20 53 28 65 29 7b 63 6f 6e 73 74 5b 74 2c 6e 5d 3d Data Ascii: ement(c.Link,{href:e.termsUrl,className:s()("automation_terms_link",p.termsUrl),text:t.trans((0,d.t)("raf_terms_and_conditions_link",{variables:{start_link:"",end_link:""}}))}))}var N=n("153d6f65"),T=n("58b42b7d"),x=n("43bedd84");function S(e){const[t,n]=
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 73 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 75 62 74 69 74 6c 65 43 6f 70 79 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 61 64 64 50 72 6f 70 65 72 74 79 46 6f 72 6d 55 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 Data Ascii: rectives:[]},{kind:"Field",name:{kind:"Name",value:"css"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"subtitleCopy"},arguments:[],directives:[]}]}}]}}]}},{kind:"Field",name:{kind:"Name",value:"addPropertyFormUrl"},arguments:[],direc
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 29 3a 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 5f 2e 5a 2c 7b 66 69 72 73 74 41 6e 69 6d 61 74 69 6f 6e 3a 65 3d 3e 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 7b 73 68 6f 77 3a 74 2c 6e 61 6d 65 3a 6e 2c 6c 61 6e 67 75 61 67 65 43 6f 64 65 3a 61 7d 3d 65 3b 72 65 74 75 72 6e 20 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6f 28 29 28 67 2e 5a 2e 6c 69 73 74 5f 79 6f 75 72 5f 70 72 6f 70 65 72 74 79 2c 74 3f 67 2e 5a 2e 73 68 6f 77 3a 67 2e 5a 2e 68 69 64 65 29 7d 2c 68 28 6e 2c 61 29 3f 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 76 2e 54 72 61 6e 73 2c 7b 74 61 67 3a 22 62 68 5f 70 61 69 5f 75 73 65 72 5f 6e 61 6d 65 5f 6c 69 73 74 5f 70 72 6f 70 65 72 74 79 5f 61 Data Ascii: ):r().createElement(_.Z,{firstAnimation:e=>function(e){const{show:t,name:n,languageCode:a}=e;return r().createElement("div",{className:o()(g.Z.list_your_property,t?g.Z.show:g.Z.hide)},h(n,a)?r().createElement(v.Trans,{tag:"bh_pai_user_name_list_property_a
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 35 30 2e 31 31 20 33 36 2e 38 34 39 39 20 35 34 2e 33 43 33 36 2e 36 32 33 36 20 35 35 2e 35 33 34 34 20 33 36 2e 37 36 31 32 20 35 36 2e 38 30 38 31 20 33 37 2e 32 34 35 39 20 35 37 2e 39 36 35 37 43 33 37 2e 37 33 30 36 20 35 39 2e 31 32 33 34 20 33 38 2e 35 34 31 36 20 36 30 2e 31 31 35 31 20 33 39 2e 35 38 20 36 30 2e 38 32 43 34 32 2e 37 20 36 33 2e 31 31 20 34 35 2e 38 32 39 39 20 36 32 2e 38 32 20 34 38 2e 36 38 39 39 20 36 30 2e 34 35 4c 35 33 2e 38 33 20 37 34 2e 35 39 48 35 34 2e 32 32 39 39 43 35 33 2e 39 31 39 39 20 37 34 2e 37 34 20 35 33 2e 36 31 39 39 20 37 34 2e 39 31 20 35 33 2e 32 39 39 39 20 37 35 2e 30 33 4c 31 39 2e 32 39 39 39 20 38 37 2e 35 39 43 31 38 2e 30 30 39 39 20 38 38 2e 30 36 20 31 37 2e 32 39 39 39 20 38 37 2e 37 32 20 31 Data Ascii: 50.11 36.8499 54.3C36.6236 55.5344 36.7612 56.8081 37.2459 57.9657C37.7306 59.1234 38.5416 60.1151 39.58 60.82C42.7 63.11 45.8299 62.82 48.6899 60.45L53.83 74.59H54.2299C53.9199 74.74 53.6199 74.91 53.2999 75.03L19.2999 87.59C18.0099 88.06 17.2999 87.72 1
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 22 23 46 46 46 22 2c 73 74 72 6f 6b 65 57 69 64 74 68 3a 22 32 22 7d 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 72 65 63 74 22 2c 7b 6f 70 61 63 69 74 79 3a 22 2e 35 22 2c 78 3a 22 31 22 2c 79 3a 22 31 22 2c 77 69 64 74 68 3a 22 32 31 22 2c 68 65 69 67 68 74 3a 22 32 38 22 2c 72 78 3a 22 31 30 2e 35 22 7d 29 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 31 2e 35 20 36 2e 35 76 36 22 2c 73 74 72 6f 6b 65 4c 69 6e 65 63 61 70 3a 22 73 71 75 61 72 65 22 7d 29 29 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 67 22 2c 7b 66 69 6c 6c 3a 22 23 46 46 46 22 2c 66 69 6c 6c 52 75 6c 65 3a 22 6e 6f 6e 7a 65 72 6f 22 7d 2c 72 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 Data Ascii: "#FFF",strokeWidth:"2"},r().createElement("rect",{opacity:".5",x:"1",y:"1",width:"21",height:"28",rx:"10.5"}),r().createElement("path",{d:"M11.5 6.5v6",strokeLinecap:"square"})),r().createElement("g",{fill:"#FFF",fillRule:"nonzero"},r().createElement("pat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.5	50661	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	617	OUT	GET /backend_static/common/flags/new/48/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:11 UTC	756	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 677 Connection: close Server: nginx Date: Mon, 15 Jan 2024 23:17:11 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-2a5" Expires: Wed, 14 Feb 2024 23:17:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 13af704549c5ac5d9fb78e3b737019ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: WU_OzPQnJ-G2S23Ktpgvi9uixIdQBqJOy_e4xzBQEvM3nGv_YI9ZuQ==
2024-01-15 23:17:11 UTC	677	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 30 08 03 00 00 00 85 42 cc d9 00 00 00 7e 50 4c 54 45 b5 1e 30 ff ff ff d2 78 84 e1 a5 ac bd 35 45 f1 d4 d7 e9 bc c0 b4 1f 30 ff ff ff 3c 3a 70 d0 73 7d ec c7 cb e3 ab b1 48 46 79 54 53 82 64 4f 7a be 3b 4a be 3b 49 6d 6b 94 61 5f 8b 9d 9c b7 79 77 9d c2 c2 d2 b6 b5 c9 ce ce db 85 84 a6 f3 f3 f6 96 27 41 e7 e7 ed da da e4 aa a9 c0 91 90 ae 6d 6b 93 91 90 af 85 83 a5 60 5f 8b 91 91 ae ab 64 7b c0 a3 b4 92 90 af bc 96 a8 a7 40 56 35 ed 65 0d 00 00 00 07 74 52 4e 53 9f 9f 9f 9f 9f 9f 9f 76 87 ee e5 00 00 01 cf 49 44 41 54 48 c7 cd 94 c9 72 dc 30 0c 44 e5 25 b1 68 1b 48 c2 75 a8 68 b1 66 b2 fe ff 0f 1a 68 ba 6c 97 7d 10 55 c5 83 fa f0 8a a7 26 d1 20 d0 99 0a fd bc db 54 27 46 6c 8d 88 40 f3 Data Ascii: PNGIHDRH0B~PLTE0x5E0<:ps}HFyTSdOz;J;Imka_yw'Amk`_d{@V5etRNSvIDATHr0D%hHuhfhl}U& T'Fl@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.5	50660	52.85.132.114	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	615	OUT	GET /cdata/joinapp/property_full_control.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:11 UTC	585	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 421074 Connection: close Date: Sun, 07 Jan 2024 17:42:00 GMT Last-Modified: Wed, 26 Jul 2023 12:42:32 GMT ETag: "a396a8f792199d1d44770bdc84a198e0" x-amz-storage-class: STANDARD_IA x-amz-server-side-encryption: AES256 x-amz-version-id: YIM1zPH9vTK8bBxFP35..uz31gwsIVv_ Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6306947fb6ab60dc617ca2e025941652.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: fEJDG4dN9JQmLiiD4fYBts7vstvOuZSRKKbk-4qS3hxK2Yk2gSBdew== Age: 711312
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 2c 00 00 01 a4 08 06 00 00 00 12 7c 7e c1 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 06 6c 67 49 44 41 54 78 01 bc fd 09 d4 6d db 55 1e 06 ce b5 f6 3e ed df de fe de d7 e9 a9 43 1d 20 01 02 d1 49 08 49 48 a1 71 ca 24 ce 18 35 46 aa 0a d7 a8 1a 15 db 15 3c ca 94 bb 72 6c 81 8c 04 98 8a 13 63 9b d8 26 ae 78 8c 2a 8f 54 6a a4 8c 13 ec 38 76 82 a1 62 d3 23 81 84 40 12 7a 42 af 7f b7 bf 7f 7b fa bd d7 aa f9 cd 66 ed fd df 77 5f 27 9c 1c e9 be bf 3b 67 ef b5 57 33 e7 37 bf d9 85 1f f9 b3 ff bb 1f f9 f0 77 7f f8 87 1f 7f e7 77 d2 cd 34 a4 df fe e2 ef d3 ce f1 21 ed 54 4b fa fc 6f 3f 49 bf f3 3b 9f Data Ascii: PNGIHDR,\|~pHYssRGBgAMAalgIDATxmU>C IIHq$5F<rlc&x*Tj8vb#@zB{fw_';gW37ww4!TKo?I;
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 52 be df 03 ca 00 1a 2e 6e ab 90 3c e2 79 bb c0 ae b9 4d 36 ea bb d5 7d 8b 82 72 97 c6 41 2a 9e b6 cc b2 6c f3 dc 20 b3 67 ce ae 32 64 fb 8c 98 65 79 f2 90 c1 58 a3 ee bb 3a 6a 21 38 26 59 24 a8 17 6c e6 c0 69 6f fb 02 6b 71 6b 10 84 d9 c1 ba 22 8b ed 94 5d 77 52 bd 35 aa 15 bf cf 6b 86 f6 05 e7 59 40 0b ab c0 f7 d7 0a a5 aa 84 b0 46 23 89 87 d1 b8 36 14 21 03 4b 27 ac 4e 0c 5a 6b a5 ae 4b 55 d9 32 00 a7 59 08 71 3b a4 7d a7 42 6f 3f e5 ce 95 2b b1 15 d6 fb a5 35 a1 27 71 1c 8d 02 91 8d c5 b2 68 77 65 5d bd ca 80 ae 9e cf 58 c0 ac 28 c5 a6 25 97 47 78 b7 b3 46 ce d6 66 ab 81 e1 0d 05 85 21 b1 26 7e 74 a6 06 53 28 02 dc 3b 74 7b 49 07 c8 2b 61 5f 5a 65 67 36 12 07 d4 8a d2 10 00 66 6e 36 b9 4f 50 c3 aa aa 62 8f 99 35 c3 c8 5c 25 60 0d 24 b5 bc 1e 18 83 a0 Data Ascii: R.n<yM6}rA*l g2deyX:j!8&Y$liokqk"]wR5kY@F#6!K'NZkKU2Yq;}Bo?+5'qhwe]X(%GxFf!&~tS(;t{I+a_Zeg6fn6OPb5\%`$
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 95 ae 5d 97 21 7b 34 e0 56 c9 36 2b 8e 67 56 9e 8f cd c1 15 36 87 48 e0 a4 f1 16 1e 4f 96 6c 5d bd b2 ae 67 8a c8 be ca d6 2a 80 ba 1e 32 de d6 45 63 85 2c 77 ca 06 98 ad aa aa 76 0d f6 f8 19 05 6d d0 1d 5e 6f 46 95 ba 31 4d 41 19 1f 97 e3 6e f0 a8 2e 8a c2 c8 ed 4d 13 33 bd 43 65 04 cc a2 6f 2d ab 05 5b 0f ec c5 11 62 f2 b2 02 35 e5 ce 6c d2 ad 12 b3 1a d2 16 6f 11 94 79 90 11 1a 0b 98 0b 68 53 25 ab 40 24 08 f3 a9 64 9e d5 0c 8a 54 d2 cb b5 21 a9 02 89 89 b4 17 51 cd 96 4c b7 26 47 6c 99 8a 5b 4f b8 c7 ac 45 0c a3 ed ed 1c 2c ce c7 ea aa e8 02 06 4b 53 d6 1a 6a 8d 01 6a 09 16 07 b3 d1 50 61 77 95 b0 53 2f 0a 66 78 3c ec 5c 84 a5 86 51 a0 b2 97 5a 63 57 24 b4 2e ab 8b 0b df 97 66 9f 76 86 35 b6 b3 e7 7d b1 8e dc 5e d3 07 8e 3a 30 ef 78 b7 f6 4d 52 d0 25 Data Ascii: ]!{4V6+gV6HOl]g*2Ec,wvm^oF1MAn.M3Ceo-[b5loyhS%@$dT!QL&Gl[OE,KSjjPawS/fx<\QZcW$.fv5}^:0xMR%
2024-01-15 23:17:11 UTC	15210	IN	Data Raw: 07 3f 4d 45 d4 a9 cd 26 42 de 7c 08 a8 38 ea 82 00 ae b0 92 a0 08 2b cc eb c6 04 58 b0 89 8b ce 0a 03 11 cd a1 9f 81 cf 25 c2 5d 1d a1 9f a3 c4 d0 54 f6 f3 15 ef 99 49 c9 7d b0 f2 de e0 23 14 c0 93 5e 7a cc 6d 1f b7 00 a1 3d cf 26 98 68 85 74 1b ea 69 c1 45 7d 2f ad 1d db de cb 26 d8 d9 04 28 9b d7 c2 39 da fb 6c bf b7 0e 92 6e 03 54 fe f7 9d fb f7 e5 0f fe d1 3f 22 7f ed 3f fa 41 f9 7f fe 9d ff ca 8a 93 ad d2 c2 2c 75 a4 1e 8b d5 5e 39 da df 91 59 0e 3d 4c a6 13 a6 60 26 53 cc b6 f1 f3 fa 7a f3 d9 b9 bc f5 ce 53 13 c2 7b 87 7b e8 30 6c d5 75 51 4d 17 bc 95 ce d6 aa 57 3c d5 a5 7c bc db cb bd 7c bc ee 01 1d d3 f3 37 df 94 bb af bf 6e a0 45 d7 ce fb 1e 1e b3 7e 90 bb 34 b9 36 27 c2 cc 8b 1c 0a ba 3c 97 e3 fb 0f e4 9f fa c6 5f 2b 3f f4 5f fc 88 3c fb dc 3b Data Ascii: ?ME&B\|8+X%]TI}#^zm=&htiE}/&(9lnT?"?A,u^9Y=L`&SzS{{0luQMW<\|\|7nE~46'<_+?_<;
2024-01-15 23:17:11 UTC	16384	IN	Data Raw: 03 91 f7 2b a6 cb bb 18 0a c9 db e7 2c b2 d0 ab 82 61 b4 c2 60 06 5e 4a e5 0a be 30 c3 a6 ea 24 8e b4 a8 0d 3f eb ff 8b 1f fd 5c be b1 59 76 b3 06 14 84 eb a6 46 a8 51 c1 bb cc 0b cf e0 44 4a 2c d9 2c 46 da 8b d9 1a 13 ba cc 2c f6 0f e8 c9 ba 09 6e d1 63 82 35 c6 75 7d 3d 98 b5 15 0a 22 85 b7 c3 b2 76 16 73 80 98 3c c1 2b d6 2f d0 73 9a 97 45 fc e1 a0 49 13 9f b3 78 90 c6 c1 8a 77 3d e5 4a 2d 1b d7 27 02 8b 2b 95 85 e0 3c 97 82 08 d3 c6 f1 21 f1 c1 06 71 4f 1c c8 50 18 93 0b 8e 36 c4 52 5e 37 1d 2c 9f d7 6b db a9 b6 1f b7 0e 40 fc bd 6d 8a 7e 1b 77 a5 fd bc 08 29 7f 5f d6 c1 5a 73 d5 35 a0 d3 8e 23 ae 3d 8b ed e3 74 a0 d3 82 a4 cd b1 af 5f 2f dd b8 c7 97 81 b5 6d d7 6c 5f ed 98 fd 98 fd bb 0f e4 f7 7e fb 77 c9 ff e3 2f ff 05 f9 bf fe 67 3f 64 82 ed 7a b9 Data Ascii: +,a`^J0$?\YvFQDJ,,F,nc5u}="vs<+/sEIxw=J-'+<!qOP6R^7,k@m~w)_Zs5#=t_/ml_~w/g?dz
2024-01-15 23:17:11 UTC	2804	IN	Data Raw: 7a e3 ad e8 85 2c 7b 20 ff 7e 95 2d c3 91 13 aa c2 0f 39 ee 1a c0 63 a5 3d d4 6b 36 01 0a 50 82 9b d7 74 69 34 99 92 d2 1c 0e 77 17 eb 7a 0a c2 e2 33 28 34 77 95 43 54 36 e5 05 4d 8e e4 5f 8e 15 b5 96 49 a2 e2 2b 53 16 98 82 18 6c d1 94 98 22 67 25 72 a1 aa c0 b1 52 e4 c9 0b e1 48 91 37 91 8b de 38 08 02 2b ce 91 6d 4d c3 0f 65 42 43 e8 de 4b ef 6f 7d b5 ca d1 d1 f1 fa e7 b7 2b d8 75 ef 42 5a 3b 5f eb 79 01 20 d8 bc 8e ff 1d 6e 9c a3 3d 4f f9 9d 0f 6a 73 bc eb 9f b7 ef a7 35 2f 90 ff bd 79 cc e6 f5 2a 30 4a b2 e9 3d 49 1b c0 60 ed b3 2d c7 b7 f7 b7 3e 87 e9 c6 77 b6 79 54 36 cf ff 85 bc 1e 7d f8 cb e4 7f fa ed df 2d bf fe ab 3f 62 e0 e0 34 2b a3 14 27 d6 72 dd 94 a8 7a 2d b3 22 d7 7e 5d b6 57 22 c8 ed 0a 38 ae 73 88 c4 72 8c 46 27 a1 61 8d 1b f7 85 0a d8 Data Ascii: z,{ ~-9c=k6Pti4wz3(4wCT6M_I+Sl"g%rRH78+mMeBCKo}+uBZ;_y n=Ojs5/y*0J=I`->wyT6}-?b4+'rz-"~]W"8srF'a
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 23 b1 6a 2e 33 90 28 c7 dc c3 3f b5 50 16 bc 4e 53 05 57 0a 28 99 66 df 83 be 53 52 db 4b 55 63 a8 19 54 0e 4e 98 e7 55 aa ba a9 95 fd ad 05 a1 4e 04 2b 83 ef fb 0d 9b d3 b2 0d db a7 18 b8 5e 54 8e 0c 9c 2b 1b 33 01 f9 28 55 fe d9 b1 22 eb 3b 9e 49 29 5a dc 55 43 ce 28 4e 27 ec 7a ee 25 4b bc c5 42 0f 5d 3c 24 96 3e 11 02 57 1a 3a 54 c7 de 01 da af 67 2d 14 74 9e 94 93 13 20 4c 12 f5 bd b1 68 b4 a7 87 a2 4d ed d2 3a 5f 21 d3 47 27 eb a3 6f 2e e4 67 3e 73 51 0a 5c 79 cc 4b 7f 57 02 ad c5 1a a7 b1 d4 07 70 eb af f8 2a 92 97 bc c6 ef f0 c8 50 a9 70 06 62 b3 f5 ac bc b8 c0 8d dd b3 67 91 23 c1 e4 0b ad 90 d7 b8 89 13 10 20 77 da 9a e2 4e 52 c1 85 83 a8 f2 b9 2b 2d 71 c5 15 eb 7b 5c 94 23 59 51 a3 33 99 60 07 53 e9 56 22 64 27 e4 e9 24 e1 76 7d 39 00 d8 f6 6a Data Ascii: #j.3(?PNSW(fSRKUcTNUN+^T+3(U";I)ZUC(N'z%KB]<$>W:Tg-t LhM:_!G'o.g>sQ\yKWp*Ppbg# wNR+-q{\#YQ3`SV"d'$v}9j
2024-01-15 23:17:12 UTC	2804	IN	Data Raw: 05 ad b2 c5 d9 5b 10 b7 29 24 80 4f fa 85 c0 ca b0 24 65 20 41 f6 05 47 42 a2 22 5d 6c 43 40 c6 22 6b 37 a1 da db e1 fd 25 d6 ab e3 60 3d 3a c7 2e b2 1e 64 59 cf 2d b6 39 7e ae 41 a3 eb 74 91 3d 68 8a 00 d4 bd 68 41 f4 a4 88 a9 5c c0 70 30 80 f5 7b 6b 70 e7 ca 0d 78 62 d9 c3 2a 32 1f 59 3b 83 75 bf 82 9f 4d a0 d9 5b 86 cb 5b 00 b7 be 37 00 57 6c 20 7b d2 40 a0 94 41 7f 58 f0 b9 76 11 8c 6c 6c 4f 58 f0 b5 9a 15 74 5b 5d 78 ff ea 0e a7 25 af 2c 22 cb 92 95 70 6f 73 0c ab 08 58 16 bb 0e 1e 6c 97 b0 89 ee a4 f1 f1 02 56 57 5a f0 bd 0f f6 e1 fa ed 02 2e ae e6 3c 65 d4 87 6d 7f 54 48 27 7b 8b 1f d1 cc 2d 5f 67 b4 5c 7a e2 f2 24 fc d4 42 20 89 45 55 65 2d ce 8e d3 dd 9d b8 98 c7 28 3b db 54 46 5d e3 94 9c 5a c6 c4 ce 11 30 ea 36 88 41 d1 27 ec 6a 59 21 2a 09 73 Data Ascii: [)$O$e AGB"]lC@"k7%`=:.dY-9~At=hhA\p0{kpxb2Y;uM[[7Wl {@AXvllOXt[]x%,"posXlVWZ.<emTH'{-_g\z$B EUe-(;TF]Z06A'jY!s
2024-01-15 23:17:12 UTC	12792	IN	Data Raw: f3 e8 25 eb 04 38 53 33 70 2b 07 d1 0f 02 17 38 0d 5f 46 ca f3 60 0d 1b 73 a7 85 4d 9d 31 46 21 1a da 21 99 23 ba f6 4c 73 08 5f 25 06 bb 9a 1a 35 59 e1 e2 c4 69 0e 7b a8 c1 25 3d 2e cd 8f fe 0d 10 e5 76 b0 e3 82 c4 f5 e8 83 85 18 b0 ac 15 87 e5 1c ea 46 52 5d d5 eb e4 d0 42 1d 1d d4 45 68 c0 81 ca 87 34 98 91 f3 30 2a c5 45 d7 e4 9e 43 62 60 50 0c 0a 1b e6 f4 3d cd f8 93 ea d3 f8 2f 68 5d 9a 2a b9 bd 32 d9 f0 3c 70 2a 9a 98 e5 e2 1b 24 f9 c5 cc 97 ea 71 cd c9 61 a2 82 64 ca 68 4c 95 f0 c7 d1 5d 24 35 87 b4 02 35 de 53 ae 52 af 00 11 f4 34 26 32 e8 59 1e 05 50 f2 82 74 ad 86 9e 50 d0 ed 95 eb f7 59 d1 76 e7 17 50 d0 b4 d0 82 d9 c1 cd bc 07 5b 54 1f c1 b9 a9 42 34 e4 57 6a a2 15 c4 81 af 68 45 f9 ae 63 ff 94 d1 b8 60 55 ed 82 d4 22 60 3f 94 93 89 21 c4 9d Data Ascii: %8S3p+8_F`sM1F!!#Ls_%5Yi{%=.vFR]BEh40ECb`P=/h]2<p*$qadhL]$55SR4&2YPtPYvP[TB4WjhEc`U"`?!
2024-01-15 23:17:12 UTC	14368	IN	Data Raw: 66 82 96 2f d0 39 62 25 63 b1 3a e8 76 42 80 41 96 dd c7 77 6f c2 ce dd ab 70 e5 dd 3f 86 ce fa 35 e8 ac cc 21 d3 33 81 11 ba 75 4c a8 51 c6 92 f5 02 db da 45 6b 70 6f c2 4a 7d 34 dc 47 a1 e8 38 5d 76 1f e5 fa 02 fa 7a b6 37 1e 40 7f 67 87 e9 ee a0 d6 e1 c5 f3 67 51 f0 f7 61 3c ea c3 d9 05 3c d7 64 0d 3e 7c eb bb e0 16 8f c1 d7 bf fa 2f e1 ee 9d 75 a4 e1 1f c0 0e 02 9d 50 0c 60 12 9e 90 7a 15 9a c6 d9 f0 25 c7 39 10 9b c2 01 8f 59 cd 04 50 b9 93 e7 79 74 0f 31 cb 02 49 21 73 ff 35 56 38 95 b4 5b a0 c7 56 4a 62 01 85 0c 52 b6 d2 5c 2b 93 39 ad a4 16 4b 15 33 7e 54 51 c9 26 56 9a 5f a2 13 aa b8 5e ad b0 a6 c1 a5 d4 03 2e f7 2e ea 7a ef 52 e7 e8 61 21 6e f6 dc 45 ee 5a b3 3c 24 70 d4 02 b3 9d 3e 3f 25 fd 40 4c 44 5d 27 19 c4 12 f3 4e 6a 4b 20 f8 75 3c 0f 9c Data Ascii: f/9b%c:vBAwop?5!3uLQEkpoJ}4G8]vz7@ggQa<<d>\|/uP`z%9YPyt1I!s5V8[VJbR\+9K3~TQ&V_^..zRa!nEZ<$p>?%@LD]'NjK u<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.5	50662	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	548	OUT	GET /libs/perimeterx/px.v7.5.3.min.js HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 275294 Connection: close Server: nginx Date: Tue, 02 Jan 2024 08:18:08 GMT Last-Modified: Wed, 29 Nov 2023 23:25:16 GMT ETag: "6567c85c-4335e" Expires: Thu, 01 Feb 2024 08:18:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 df08ba5d249ec7fb2513313ea66b59f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: KdAJlsZNyINSfxyVqHa3zBo9QIxD0EeY61EaXh0Ho8n0NyqZylxI5g== Age: 1177143
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 2f 2f 20 40 6c 69 63 65 6e 73 65 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 34 2d 32 30 32 32 20 50 65 72 69 6d 65 74 65 72 58 2c 20 49 6e 63 20 28 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 29 2e 20 20 43 6f 6e 74 65 6e 74 20 6f 66 20 74 68 69 73 20 66 69 6c 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 63 6f 70 69 65 64 20 61 6e 64 2f 6f 72 20 64 69 73 74 72 69 62 75 74 65 64 2e 0a 74 72 79 7b 77 69 6e 64 6f 77 2e 5f 70 78 41 70 70 49 64 3d 22 50 58 69 6b 4b 75 4c 32 52 4d 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 3f 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d Data Ascii: // @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed.try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.perform
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 74 28 22 6f 6e 22 2b 65 2c 72 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 64 65 28 6f 28 22 4e 47 42 62 64 77 52 4c 63 77 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 74 28 74 29 7b 72 65 74 75 72 6e 20 74 3f 74 2e 72 65 70 6c 61 63 65 28 2f 5c 73 7b 32 2c 31 30 30 7d 2f 67 2c 22 20 22 29 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 72 5c 6e 5c 74 5d 2b 2f 67 2c 22 5c 6e 22 29 3a 22 22 7d 66 75 6e 63 74 69 6f 6e 20 57 74 28 74 29 7b 76 61 72 20 65 3d 5b 5d 3b 69 66 28 21 74 29 72 65 74 75 72 6e 20 65 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 72 3d 76 6f 69 64 20 30 2c 6f 3d 6e 75 6c 6c 2c 69 3d 2f 5e 5c 73 2a 61 74 20 28 2e 2a 3f 29 20 3f 5c 28 3f 28 28 3f 3a 66 69 6c 65 3a 5c 2f 5c 2f 7c 68 74 74 70 73 3f 3a 5c 2f 5c 2f 7c 62 6c 6f 62 7c Data Ascii: t("on"+e,r))}catch(t){}de(o("NGBbdwRLcw"))}function Xt(t){return t?t.replace(/\s{2,100}/g," ").replace(/[\r\n\t]+/g,"\n"):""}function Wt(t){var e=[];if(!t)return e;for(var n=t.split("\n"),r=void 0,o=null,i=/^\sat (.?) ?\(?((?:file:\/\/\|https?:\/\/\|blob\|
2024-01-15 23:17:12 UTC	2410	IN	Data Raw: 49 63 67 22 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 6e 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 7d 2c 22 22 29 29 2c 78 65 28 6f 6c 2e 69 29 29 7b 61 65 28 65 28 22 4e 47 42 62 64 67 64 41 63 41 22 29 29 3b 76 61 72 20 72 3d 51 65 28 51 6c 29 3b 74 5b 65 28 22 4e 47 42 62 64 67 31 42 63 41 22 29 5d 3d 72 5b 4c 6c 5d 2c 74 5b 65 28 22 4e 47 42 62 64 67 31 4f 63 67 22 29 5d 3d 21 21 72 5b 5a 6c 5d 2c 74 65 28 74 2c 65 28 22 4e 47 42 62 64 67 4a 49 64 51 22 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 72 5b 6b 6c 5d 2e 63 61 6c 6c 28 74 68 69 73 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 79 75 29 2c 4a 6c 29 3b 69 66 28 74 29 72 65 74 75 72 Data Ascii: Icg"),function(){return dn(Object.prototype.hasOwnProperty)},"")),xe(ol.i)){ae(e("NGBbdgdAcA"));var r=Qe(Ql);t[e("NGBbdg1BcA")]=r[Ll],t[e("NGBbdg1Ocg")]=!!r[Zl],te(t,e("NGBbdgJIdQ"),function(){var t=r[kl].call(this,Object.getPrototypeOf(yu),Jl);if(t)retur
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 4a 35 22 29 5d 7d 63 61 74 63 68 28 74 29 7b 7d 7d 28 29 3b 72 26 26 28 74 5b 65 28 22 4e 47 42 62 64 67 5a 4b 65 67 22 29 5d 3d 72 5b 4b 28 22 64 58 4e 6c 5a 45 70 54 53 47 56 68 63 46 4e 70 65 6d 55 3d 22 29 5d 2c 74 5b 65 28 22 4e 47 42 62 64 67 5a 50 64 41 22 29 5d 3d 72 5b 4b 28 22 61 6e 4e 49 5a 57 46 77 55 32 6c 36 5a 55 78 70 62 57 6c 30 22 29 5d 2c 74 5b 65 28 22 4e 47 42 62 64 67 46 4d 63 67 22 29 5d 3d 72 5b 4b 28 22 64 47 39 30 59 57 78 4b 55 30 68 6c 59 58 42 54 61 58 70 6c 22 29 5d 29 3b 74 72 79 7b 74 5b 65 28 22 4e 47 42 62 64 67 46 4d 65 77 22 29 5d 3d 4e 75 2e 44 61 74 65 28 29 2c 74 5b 65 28 22 4e 47 42 62 64 67 5a 4b 64 51 22 29 5d 3d 21 21 4e 75 2e 42 75 66 66 65 72 2c 74 5b 65 28 22 4e 47 42 62 64 67 5a 4f 64 51 22 29 5d 3d 4e 75 2e Data Ascii: J5")]}catch(t){}}();r&&(t[e("NGBbdgZKeg")]=r[K("dXNlZEpTSGVhcFNpemU=")],t[e("NGBbdgZPdA")]=r[K("anNIZWFwU2l6ZUxpbWl0")],t[e("NGBbdgFMcg")]=r[K("dG90YWxKU0hlYXBTaXpl")]);try{t[e("NGBbdgFMew")]=Nu.Date(),t[e("NGBbdgZKdQ")]=!!Nu.Buffer,t[e("NGBbdgZOdQ")]=Nu.
2024-01-15 23:17:12 UTC	12821	IN	Data Raw: 30 2c 65 28 22 22 2c 24 72 2c 7a 72 29 29 7d 66 75 6e 63 74 69 6f 6e 20 24 72 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 3b 69 66 28 21 44 73 29 7b 76 61 72 20 6f 3b 44 73 3d 21 30 2c 59 73 3d 65 3b 76 61 72 20 69 3d 41 74 28 29 2c 63 3d 28 6f 3d 7b 7d 2c 76 72 28 6f 2c 72 28 22 4e 47 42 62 64 67 4e 4a 64 67 22 29 2c 65 65 28 69 29 29 2c 76 72 28 6f 2c 72 28 22 4e 47 42 62 64 67 4a 4c 65 67 22 29 2c 74 29 2c 76 72 28 6f 2c 72 28 22 4e 47 42 62 64 67 42 49 64 51 22 29 2c 52 74 28 29 29 2c 6f 29 3b 6a 6f 28 72 28 22 4e 47 42 66 63 41 55 22 29 2c 63 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 6f 28 29 7b 72 65 74 75 72 6e 20 50 73 28 4e 75 5b 22 5f 5f 22 2b 4b 67 2b 22 5f 5f 22 5d 29 3d 3d 3d 4d 75 26 26 21 21 76 75 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 4a Data Ascii: 0,e("",$r,zr))}function $r(t,e){var r=n;if(!Ds){var o;Ds=!0,Ys=e;var i=At(),c=(o={},vr(o,r("NGBbdgNJdg"),ee(i)),vr(o,r("NGBbdgJLeg"),t),vr(o,r("NGBbdgBIdQ"),Rt()),o);jo(r("NGBfcAU"),c)}}function to(){return Ps(Nu["__"+Kg+"__"])===Mu&&!!vu.getElementById(J
2024-01-15 23:17:12 UTC	15990	IN	Data Raw: 21 65 7c 7c 21 72 26 26 21 6f 7c 7c 2d 31 21 3d 3d 42 28 6a 62 2c 74 29 29 72 65 74 75 72 6e 3b 69 66 28 6a 62 2e 70 75 73 68 28 74 29 2c 72 26 26 76 75 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 72 29 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 3b 69 66 28 6f 26 26 76 75 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 6f 29 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 3b 76 61 72 20 69 3d 76 75 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 65 29 3b 69 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 2c 72 26 26 28 69 2e 6e 61 6d 65 3d 72 29 2c 6f 26 26 28 69 2e 63 6c 61 73 73 4e 61 6d 65 3d 6f 29 2c 4a 74 28 69 2c 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 69 3d 6e Data Ascii: !e\|\|!r&&!o\|\|-1!==B(jb,t))return;if(jb.push(t),r&&vu.getElementsByName(r).length>0)return;if(o&&vu.getElementsByClassName(o).length>0)return;var i=vu.createElement(e);i.style.display="none",r&&(i.name=r),o&&(i.className=o),Jt(i,"click",function(){var e,i=n
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 73 64 28 74 29 7b 76 61 72 20 65 3d 6e 2c 72 3d 41 74 28 29 2c 6f 3d 57 74 28 72 29 2c 69 3d 76 6f 69 64 20 30 3b 69 66 28 6f 2e 6c 65 6e 67 74 68 3e 30 29 7b 76 61 72 20 63 2c 61 3d 6f 5b 6f 2e 6c 65 6e 67 74 68 2d 31 5d 3b 63 3d 7b 7d 2c 66 64 28 63 2c 65 28 22 4e 47 42 62 64 67 4e 4a 64 67 22 29 2c 72 29 2c 66 64 28 63 2c 65 28 22 4e 47 42 62 64 67 64 50 64 41 22 29 2c 74 29 2c 66 64 28 63 2c 65 28 22 4e 47 42 62 64 67 31 50 63 51 22 29 2c 61 5b 31 5d 7c 7c 22 22 29 2c 66 64 28 63 2c 65 28 22 4e 47 42 62 64 67 4a 50 64 67 22 29 2c 61 5b 30 5d 7c 7c 22 22 29 2c 69 3d 63 7d 65 6c 73 65 7b 76 61 72 20 64 3b 64 3d 7b 7d 2c 66 64 28 64 2c 65 28 22 4e 47 42 62 64 67 4e 4a 64 67 22 29 2c 72 29 2c 66 64 28 64 2c 65 28 22 4e Data Ascii: }}}function sd(t){var e=n,r=At(),o=Wt(r),i=void 0;if(o.length>0){var c,a=o[o.length-1];c={},fd(c,e("NGBbdgNJdg"),r),fd(c,e("NGBbdgdPdA"),t),fd(c,e("NGBbdg1PcQ"),a[1]\|\|""),fd(c,e("NGBbdgJPdg"),a[0]\|\|""),i=c}else{var d;d={},fd(d,e("NGBbdgNJdg"),r),fd(d,e("N
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 29 29 28 6e 2c 74 29 2e 68 72 65 66 7d 76 61 72 20 61 74 3d 50 6e 28 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 65 74 28 74 29 7b 76 61 72 20 72 3d 6e 3b 72 65 74 75 72 6e 21 21 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 29 26 26 21 28 5b 72 28 22 49 55 31 4f 51 45 56 49 54 30 59 22 29 2c 72 28 22 74 74 2f 59 77 74 50 45 31 39 58 43 33 38 44 54 22 29 2c 72 28 22 6b 2f 44 38 2f 75 50 2f 39 75 66 32 22 29 5d 2e 69 6e 64 65 78 4f 66 28 74 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 29 3c 30 29 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 6e 2c 66 3d 30 3b 74 21 3d 3d 77 69 6e 64 6f 77 3b 29 69 66 28 66 2b 3d 31 2c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 5b 72 28 22 4b 31 74 4b 57 55 35 46 58 77 Data Ascii: ))(n,t).href}var at=Pn(20);function et(t){var r=n;return!!Object.getPrototypeOf(t)&&!([r("IU1OQEVIT0Y"),r("tt/YwtPE19XC38DT"),r("k/D8/uP/9uf2")].indexOf(t.document.readyState)<0)}function it(t){for(var r=n,f=0;t!==window;)if(f+=1,null===(t=t[r("K1tKWU5FXw
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 66 2c 67 65 74 49 74 65 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 5b 6e 5d 7d 2c 73 65 74 49 74 65 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 6e 5d 3d 72 7d 2c 72 65 6d 6f 76 65 49 74 65 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 5b 6e 5d 3d 6e 75 6c 6c 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 66 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 76 61 72 20 72 2c 66 2c 6f 3d 6e 2e 67 65 74 49 74 65 6d 28 74 29 3b 72 65 74 75 72 6e 20 6f 3f 28 72 3d 6f 26 26 71 6e 28 6f 29 2c 28 66 3d 46 72 28 72 29 29 2e 66 30 78 32 34 66 37 63 62 31 3f 66 2e 66 30 78 32 34 66 37 63 62 31 3e 53 28 29 3f 66 2e 66 30 78 37 30 61 33 39 31 31 34 3a 28 6e 2e 72 65 6d Data Ascii: f,getItem:function(n){return t[n]},setItem:function(n,r){return t[n]=r},removeItem:function(n){return t[n]=null}})}function Nf(n){return function(t){try{var r,f,o=n.getItem(t);return o?(r=o&&qn(o),(f=Fr(r)).f0x24f7cb1?f.f0x24f7cb1>S()?f.f0x70a39114:(n.rem
2024-01-15 23:17:12 UTC	394	IN	Data Raw: 28 22 2f 70 71 52 6b 35 2b 58 6b 41 22 29 5d 7c 7c 61 2e 70 61 74 68 29 26 26 28 61 5b 66 28 22 64 52 45 61 47 42 51 63 47 77 22 29 5d 7c 7c 22 22 29 2b 28 61 2e 70 61 74 68 7c 7c 22 22 29 2c 6f 2e 66 30 78 33 36 65 61 36 35 63 62 3d 61 5b 66 28 22 4e 45 64 52 56 30 46 47 55 51 22 29 5d 2c 6f 2e 66 30 78 36 62 31 32 64 62 32 65 3d 69 73 4e 61 4e 28 61 5b 66 28 22 39 35 71 57 6a 37 61 51 6b 67 22 29 5d 29 3f 61 5b 66 28 22 61 67 38 53 47 67 4d 59 44 78 6b 22 29 5d 26 26 28 6e 65 77 20 44 61 74 65 28 61 5b 66 28 22 4b 30 35 54 57 30 4a 5a 54 6c 67 22 29 5d 29 2d 6e 65 77 20 44 61 74 65 29 2f 31 65 33 3a 61 5b 66 28 22 58 7a 49 2b 4a 78 34 34 4f 67 22 29 5d 2c 75 61 28 22 66 30 78 37 35 31 66 34 35 39 61 22 2c 6f 2c 72 29 2c 42 28 22 66 30 78 32 30 33 35 32 Data Ascii: ("/pqRk5+XkA")]\|\|a.path)&&(a[f("dREaGBQcGw")]\|\|"")+(a.path\|\|""),o.f0x36ea65cb=a[f("NEdRV0FGUQ")],o.f0x6b12db2e=isNaN(a[f("95qWj7aQkg")])?a[f("ag8SGgMYDxk")]&&(new Date(a[f("K05TW0JZTlg")])-new Date)/1e3:a[f("XzI+Jx44Og")],ua("f0x751f459a",o,r),B("f0x20352

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.5	50663	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	614	OUT	GET /cdata/joinapp/get_bookings_quickly.png HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	586	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 426361 Connection: close Date: Sat, 30 Dec 2023 21:41:05 GMT Last-Modified: Wed, 26 Jul 2023 12:40:48 GMT ETag: "9f9f09424dc578f5d4cf6889b5037cb5" x-amz-storage-class: STANDARD_IA x-amz-server-side-encryption: AES256 x-amz-version-id: tVNl1cqwxmxpaPZ95pFQmUP53ScKPhcL Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 5DwwD_RBZ5YB-zwq8UrT7hPmWwC7402Yzt84xVHXU1f0-3pSgEEKvQ== Age: 1388167
2024-01-15 23:17:12 UTC	15798	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 2c 00 00 01 fc 08 06 00 00 00 f2 a1 f4 5b 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 06 81 0e 49 44 41 54 78 01 84 fd cb 96 64 cb 91 25 88 89 aa 1e 33 8f 1b 17 40 22 91 c8 aa 5c 59 d5 ec 6e d6 0f 70 c8 e1 fd 33 92 ff c5 09 46 9c 73 d5 e2 a4 d9 24 57 92 55 59 55 f9 00 70 71 1f e1 6e 76 54 79 44 f6 de 22 6a 01 74 b7 5f 04 c2 c3 dd ec d8 39 fa 10 d9 b2 65 8b 68 fb 1f fe 87 bf ff 3f bf 7f 7c fc 9f ce f3 69 1f 1f 0f 9b e7 69 e7 f5 a7 b5 6e a3 99 8d de ec f3 7d d8 7d 2c fb d5 e7 61 df 7e ea f6 76 bb 7e f6 76 b3 e3 18 d6 cd ac b7 76 bd ee b0 db 71 58 bb de b4 96 f9 4f e3 7f 66 d7 45 56 b7 76 5d a7 Data Ascii: PNGIHDR,[pHYssRGBgAMAaIDATxd%3@"\Ynp3Fs$WUYUpqnvTyD"jt_9eh?\|iin}},a~v~vvqXOfEVv]
2024-01-15 23:17:12 UTC	9786	IN	Data Raw: 99 98 8a 17 13 c3 9b b5 5c dc 5a 40 61 ec f9 ec da ce fe ef a3 97 20 30 10 e2 f5 5b 55 fc 3c a8 b5 88 e5 4c ca 4a f9 d4 f9 9c b9 68 aa 19 96 a8 ae 96 f4 bd 16 2e 2a 69 ce da e0 9b 91 c4 3d cf 44 97 8d a9 01 09 a0 c4 0a c4 80 9e 02 24 27 b5 2b 33 af 85 2a 18 6e b4 c5 8e a7 7a 1f 75 2b 02 58 4a d7 48 08 eb 06 0c 27 8a 32 7a 50 14 b4 c4 c0 58 45 40 b3 9c 68 8a 29 fb c6 0a 98 7e 7e 26 c0 34 46 3c fe b3 a3 6d d4 3c c1 16 36 37 99 9e b9 32 fd 92 7f b7 9d 31 2a fa 59 f9 d7 5a 05 25 40 6e 66 f6 9a be 30 53 3a 49 cf 85 d9 fa ca 91 cf 9a 0b 01 88 ea cf 01 70 d0 c8 8a 84 5e 23 a2 0b 34 97 8a b3 aa 68 cc bc 47 81 ab e7 13 0c b7 8e 23 25 1a 53 87 5d 11 25 00 b2 ff 7d d3 46 b7 8d d1 58 55 56 9c 51 30 17 3a 7a d1 20 0d 84 f4 5c 23 4b 85 f9 1a 19 51 1a 9d 24 69 7c 1a c0 Data Ascii: \Z@a 0[U<LJh.i=D$'+3nzu+XJH'2zPXE@h)~~&4F<m<6721*YZ%@nf0S:Ip^#4hG#%S]%}FXUVQ0:z \#KQ$i\|
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: d9 0e e3 59 1d 04 38 71 b2 b7 00 e2 7c 89 70 c4 0e 36 3e b7 5a af 2b 02 d3 81 a1 10 f9 52 a4 37 15 78 4c 80 21 9f 97 8f 07 a3 6c 46 c9 dc ef 73 03 7d 9a 4f 33 e6 c7 39 86 91 22 cd d6 fc 96 0c 87 d6 55 cc c2 da e6 95 0c 46 ac 7d 2f a9 67 51 13 84 ca 0f ac 3d 7e de 69 88 d6 b0 fc 7a 80 92 64 27 09 4e a3 21 60 10 13 cd 24 ec 5c 72 64 fd 35 e8 0a 84 4d 96 6c 50 0f 60 0b 3b 11 d5 2c 3d 59 4b b5 3c 78 d9 1b 56 8c 54 ec 8d 09 1b 10 f7 40 30 01 26 79 25 f0 83 e8 5f f7 83 14 ae 0d 45 ae 04 cb f1 01 48 21 ae d3 92 19 e9 db 1a 92 51 dd 85 ba ea 78 da e0 13 4c 41 54 9c d9 46 66 61 6c 22 ca bd a7 07 58 ef 8a b6 7b 4b 64 c5 e7 20 80 4d 16 b1 45 f4 0e 46 8f cf db e4 27 f0 7c 23 cf 16 53 9f ae c5 8a 14 96 2d 33 ba 8e 8f 5a 0a 14 16 75 66 18 77 b0 91 56 41 63 af fe 3a 8d Data Ascii: Y8q\|p6>Z+R7xL!lFs}O39"UF}/gQ=~izd'N!`$\rd5MlP`;,=YK<xVT@0&y%_EH!QxLATFfal"X{Kd MEF'\|#S-3ZufwVAc:
2024-01-15 23:17:12 UTC	16384	IN	Data Raw: 60 67 31 77 62 62 b0 16 8c 3e 0f 64 47 a4 cd 0d ac 1c 9a 6f f6 0c ac 15 64 cb d6 f5 51 ac a3 7c aa fe 28 20 56 b5 e0 d8 18 5a d7 da 3a 56 c1 e1 87 c7 1d 17 88 86 3b 38 49 37 d0 95 6f 10 67 2c 3e 50 56 fb f1 ee 1f 82 0e b7 19 f1 12 80 48 29 dd 36 93 fb f2 d5 b0 48 a5 7c fe c6 4f 5f 6c a0 f8 3d ef ed a9 8b c1 be 25 ca f9 06 83 81 e6 01 71 6d af 2e 70 c1 6d 00 17 07 54 dd cf 44 78 46 39 5d e0 26 75 34 5c af f7 50 b4 d6 fc 8b b7 b6 a3 b9 1d d4 ec a8 4f 3f 4b 41 11 81 19 a2 2e 20 d4 43 a5 6a 47 67 33 32 8c 08 74 22 30 aa 2e 96 5d 9b b8 2b 4e a0 de b4 40 8d d1 63 b0 13 ad 10 f4 4f df ff c1 fe cb 7f fa 07 fb fc 8b 5f 04 f0 c0 59 1e d3 7e fe e9 47 fb fe bf fd 57 fb f2 f3 4f 09 26 83 05 e0 c2 d1 5e 3a 78 20 5d 00 4b 36 b6 c2 f3 02 49 e3 54 56 63 83 38 e4 19 9f 3a Data Ascii: `g1wbb>dGodQ\|( VZ:V;8I7og,>PVH)6H\|O_l=%qm.pmTDxF9]&u4\PO?KA. CjGg32t"0.]+N@cO_Y~GWO&^:x ]K6ITVc8:
2024-01-15 23:17:12 UTC	6009	IN	Data Raw: 9d b3 5f b4 69 86 54 c3 93 5d 44 19 c9 71 d0 92 7e 4f b9 e4 4a fd 00 e8 f4 04 1c 4c 37 a5 20 91 af 19 55 5d 90 73 46 da c7 54 56 a7 57 e9 fc 2c 4d 5e 15 1d 28 a1 10 18 83 96 c6 25 e6 75 9c 27 11 f0 45 99 2f ac 05 8c 1a 7e 96 a9 ae 0e fd 8b 0e e0 4d 55 0f d3 32 67 18 c0 60 c7 10 c6 08 1c 58 25 e3 22 59 77 0e 63 49 93 68 a0 a4 3a c8 a2 51 9a 7d d8 18 72 c4 23 3b 0f 22 42 f4 68 d3 8d b6 97 7b 86 a8 79 52 3c 4a da 33 80 2a e0 8b a9 b7 81 1f 87 5b 47 cf 93 70 0e 62 8d 8c 6b 44 93 bb ed 5b ea 44 3c a4 94 31 89 ea b3 69 b9 b6 ca d7 23 82 02 15 2f f1 70 a9 cb 67 8a c3 bb 95 9e 29 c4 d7 db 9e 87 cb ef d7 db c1 63 08 64 cf cf 9f 4c 13 65 5a 68 5a 02 f7 46 aa 74 3d 44 5b ab 9c 7a 8c 1f 60 d3 ba a8 08 9a a3 ca 29 81 01 33 57 9d f3 38 a6 11 20 32 4a 6a 04 ac d2 2a 99 Data Ascii: _iT]Dq~OJL7 U]sFTVW,M^(%u'E/~MU2g`X%"YwcIh:Q}r#;"Bh{yR<J3[GpbkD[D<1i#/pg)cdLeZhZFt=D[z`)3W8 2Jj
2024-01-15 23:17:12 UTC	12792	IN	Data Raw: 0a b6 c9 c9 dc 6f 31 a7 e5 e5 de ec be f9 41 f6 66 84 2d 59 1f 94 a2 6e d4 fb c0 10 be 3f 34 71 9b 69 5c 24 4f e2 7a 6f d1 a4 69 50 87 21 6a f5 16 5a a1 cb fd d9 eb f5 4c 83 75 b9 b3 9f 8d 03 a0 89 33 24 d0 1e c7 85 7d 6f 7c 0f 79 73 38 e5 ad 35 53 ec db db 5b 54 e8 a8 53 73 bc 17 c5 b8 5b b2 7c 04 1f 21 76 c1 99 46 33 3d 8b eb 29 81 a3 85 ed 99 53 69 48 44 a5 1b 9d 50 67 d5 9e 1b 5e 7c 0f e7 fd 24 48 62 24 90 c1 8a 57 37 85 b8 ff b0 9a 33 83 93 60 60 5d 7a 9e b1 58 c7 45 e8 5e fa 21 7e 51 18 be ed 95 6a d5 98 03 1c bc 19 fa 90 9d 01 06 58 3a 55 8f b5 74 00 3a b7 c5 43 0b 5c 8f c5 5e ce 74 fc 8a fe c3 19 5f f7 ee 3d 4a c4 0c a9 fa 23 b6 ab af d3 4d 43 10 31 93 c8 df ef dd e7 16 cd 83 36 67 da 6f 7e f8 14 e7 f2 eb f5 dc fc 3c 7c 7b 60 1d 06 22 9f 64 0f 65 Data Ascii: o1Af-Yn?4qi\$OzoiP!jZLu3$}o\|ys85S[TSs[\|!vF3=)SiHDPg^\|$Hb$W73``]zXE^!~QjX:Ut:C\^t_=J#MC16go~<\|{`"de
2024-01-15 23:17:12 UTC	6396	IN	Data Raw: 5e 94 66 45 0c e0 d9 ca 86 3d dd bd b3 27 a6 c6 3b 68 1a 27 9a ec 49 98 3a 33 50 a2 76 6d 67 49 f2 84 d1 8f ca b4 41 01 67 07 00 f3 72 95 98 35 d5 d8 aa 9f 60 0d 91 7a 31 8a 8d 95 1a e9 a8 0d 73 60 32 c5 c1 06 93 70 3c dd b4 13 47 02 81 69 a8 40 27 28 bb fb 33 3e 42 38 f9 6d 52 9f 31 ef d7 3d 9a a9 da c4 2b 2c 8f 08 4a 39 5b 47 f7 b8 41 0c dc b9 8f fd 3c de b7 c6 6c f2 88 34 4d cc dd 19 d5 30 52 7b a5 93 81 39 4e b0 14 93 37 1b 5c e7 3c d3 66 34 8a 8d 65 bf 91 56 2b 96 16 e9 c2 86 96 0b 6e c3 e2 39 2a 95 3b 0a 24 75 4b 6d 26 3e 6a 30 ad ce c6 8b b4 6b 61 83 81 fa a0 af 64 96 41 d3 b8 a3 43 35 6d 95 1a a9 35 82 29 b7 17 99 2d 00 25 11 c6 c4 cb c3 df 26 c0 ca 6d a2 12 88 3b 19 59 f5 81 35 f5 f7 7d 78 8a fe e4 ec a6 53 c0 55 e0 b5 82 29 e0 8a 66 d2 ae 24 10 Data Ascii: ^fE=';h'I:3PvmgIAgr5`z1s`2p<Gi@'(3>B8mR1=+,J9[GA<l4M0R{9N7\<f4eV+n9*;$uKm&>j0kadAC5m5)-%&m;Y5}xSU)f$
2024-01-15 23:17:12 UTC	6396	IN	Data Raw: 08 18 97 ac b6 40 ad 2d c1 bf 59 05 ef d5 13 86 15 90 6d 65 58 f4 9c f0 ef 91 84 04 be af cf 1b 02 23 0a 4a b4 ab 66 e9 5d f4 ab d5 d5 be c5 7d aa c9 69 e3 b9 5c af 3b 03 da de 7f a1 6b 29 81 70 6b 63 09 50 74 4d 24 39 bc 7f 19 86 db c3 e0 0e 2b ea 06 f9 cd cb b1 34 74 ac 8b fa bd f6 c8 52 4a 6f 24 e7 c6 88 a1 80 65 23 1c a1 3d 6d 82 de 4b b7 d2 aa b9 cc 4e 60 11 15 42 ad e7 a4 62 39 d6 b8 c1 c4 94 92 4b f1 e1 46 f4 b3 a7 20 07 f9 7f cb 28 60 a3 1e 60 6d 50 17 fa 81 c2 1c c9 9c 60 a1 46 96 58 6d a4 fc fc 0b a8 6f 07 c0 b1 99 86 4f 63 b8 c3 3c e6 03 c5 b5 63 33 9f b9 1e a0 4d c9 f2 34 00 15 4c b2 54 c5 84 e8 31 88 18 05 a0 dc 41 dc 62 1e 03 ae 2d 84 6c 9c 9b 92 20 c3 2c 19 16 a5 72 dc f8 d4 d8 03 23 18 50 9f 93 99 06 e1 64 54 1b 0e 9b 8d d7 88 27 d1 15 95 Data Ascii: @-YmeX#Jf]}i\;k)pkcPtM$9+4tRJo$e#=mKN`Bb9KF (``mP`FXmoOc<c3M4LT1Ab-l ,r#PdT'
2024-01-15 23:17:12 UTC	6396	IN	Data Raw: 12 b0 66 f1 a7 a7 1e 79 16 47 04 26 8f 08 b8 fc cf d7 e8 01 f5 94 55 67 99 d2 05 fd 00 ff d2 c1 9e f8 8f 94 fe 8e d7 f0 9a 30 4c 51 7d b1 5c ab d8 63 8a b2 83 da ef ae 47 ff 67 9f 6f 17 70 b9 fe 7d e3 e4 e1 cb 10 7b b7 dc a7 6b 7b 6f f4 47 ee 84 1f de e4 d3 75 73 1d dd b1 b1 b7 19 fc 9a c4 d4 33 aa a4 10 d0 0d 76 8b 2e 3d 8f 10 4c b7 4a c7 4a 0e 14 60 e5 54 6f 29 a5 8f f1 7a 05 5d 40 3f d8 13 ab 56 2c 6c a3 15 a0 d5 73 34 82 b7 c1 6a 04 68 83 02 46 f0 ad 59 11 86 81 4e 26 18 d5 e5 77 f4 7d e4 33 d3 7e c2 c7 cf dc 13 0f cd aa 1b c5 74 4d be 66 d5 b3 95 26 b2 a7 b8 7e 5a 11 1c f5 fa 6b 2f fb 03 7f f2 06 4f 12 a4 32 b2 6d 5b 0d 11 04 4a 44 94 fe 74 01 08 bf a6 e3 9d 34 ac bf 2d 51 3d 94 e8 a0 d5 75 e1 4c d7 e2 a0 a5 ee c4 b2 e9 9a 9c 5c 44 63 8c 5c 95 4a f1 Data Ascii: fyG&Ug0LQ}\cGgop}{k{oGus3v.=LJJ`To)z]@?V,ls4jhFYN&w}3~tMf&~Zk/O2m[JDt4-Q=uL\Dc\J
2024-01-15 23:17:12 UTC	6396	IN	Data Raw: fe 7f 10 a3 4e bd 07 fd b8 f6 09 cd 51 ef 8c 9a 34 16 81 d3 d1 cb d4 ca 2a 08 6a ca 52 b1 80 25 6a 8c 0e a4 00 2d 21 8a 0d ab 7b 04 2f f9 bb f8 6b 1f 8e 6c 3d a6 00 75 6a b5 48 b7 6a 47 16 bd 70 7e 03 2d fa 9d de ce 6a 37 56 ed b5 94 06 a6 00 4c e4 1f b3 a9 fc 82 fe 97 22 2a 74 e6 c4 5c 30 41 1a b9 80 75 b0 f5 45 18 c8 19 4c 0c 1c 54 8f 7c 3f 80 15 b1 02 5b 4c 59 ce 8d c1 c8 3c f5 59 0e 13 15 1e 06 7a c1 e6 ad ea 46 09 87 da 98 93 91 54 ba 0b 63 a2 10 84 e3 ef 13 cb 62 8b bc 1a 02 8c c6 f6 67 6d b8 33 32 60 4e da a1 ac dd 9f 54 db 7e 1a 2f f8 fd 53 fb 9b f2 d6 62 dd b3 46 3a 27 07 2a 75 7d ac 1b 0d b7 92 c0 2f ef ab 9e a9 85 87 05 01 83 fb 39 c0 8f 45 65 18 0e 4d 9c ed df fc dd bf b4 f2 70 6f f9 e8 6d a0 0f b8 26 2f 05 02 00 a8 7b ea f5 8b 17 76 5d 81 83 Data Ascii: NQ4jR%j-!{/kl=ujHjGp~-j7VL"t\0AuELT\|?[LY<YzFTcbgm32`NT~/SbF:'*u}/9EeMpom&/{v]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.5	50664	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:11 UTC	633	OUT	GET /consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/501b35ec-1330-4a3f-9287-1f5f727b0f3d.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://join.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	902	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:12 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d4ae289a05e9-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 65578 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:12 GMT Last-Modified: Thu, 31 Aug 2023 13:58:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 1bZBYEvMuRBns2LI5GGtkA== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c61c3b9e-301e-009d-137c-13cb39000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:12 UTC	467	IN	Data Raw: 31 39 64 33 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 30 38 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 35 30 31 62 Data Ascii: 19d3{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202308.1.0","OptanonDataJSON":"501b
2024-01-15 23:17:12 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-01-15 23:17:12 UTC	1369	IN	Data Raw: 2d 48 61 6e 74 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 Data Ascii: -Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"e
2024-01-15 23:17:12 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-01-15 23:17:12 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-01-15 23:17:12 UTC	676	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"CookieV2VendorServiceScr
2024-01-15 23:17:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.5	50666	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	2245	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; lastSeen=1705360627956; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; _ga=GA1.2.810723182.1705360577; esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D
2024-01-15 23:17:12 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:12 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5084a25d91022b55b5acf281581c6444.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P1 X-Amz-Cf-Id: eCWwy_vKuKS1rizYxFX9fLVPGfQHRfXSrUH50Tljcde-Eo08KVEqtw==
2024-01-15 23:17:12 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.5	50665	108.138.85.49	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	3455	OUT	GET /js_tracking?sid=0059242d4bafbe759210d4ea3ea582cb&ref_action=help&pid=6880a3b6d76d00c5&stype=1&lang=en-us&ver=2&aid=304142&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|4084&m=UmFuZG9tSVYkc2RlIyh9YQNcFzDQ3JSun3Qy_smY43fuAGTvBgN4LflpwzIpPoohGF1CCvVXxBSRJQVJkag9AWYU9VfB6XJIhFThxH05tfoh6d2GnOkM0ZpWMpsPDKUWilnyz9TkVxfBDmQCPKQSAelf1mz3MHclSYpvvT3Ovek06EVbxX_UPGBogVHnUgXkwn6XQvuSA7rH2ZyFdgaSDTK0gBRDXJ3h2JK0VOSUMpq0QCCSU5Ompw HTTP/1.1 Host: secure.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; PegaIAC=IACtest; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A16%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1705360627956; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1705360577696&isGpcEnabled=0&datestamp=Tue+Jan+16+2024+00%3A17%3A09+GMT%2B0100+(Central+European+Standard+Time)&version=202308.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=fd72beb1-9e0a-49c6-942b-4ff16f3c48ee&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.810723182.1705360577; esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D
2024-01-15 23:17:12 UTC	461	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:12 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 39cace2136102a575c38c82525d3b770.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: AIBgdMWs-PFrv6SZFJqWg-iH_xS1jmam-IB0jNzNiLSB9S5q2Op0Sg==
2024-01-15 23:17:12 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.5	50667	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	381	OUT	GET /backend_static/common/flags/new/48/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	763	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 677 Connection: close Server: nginx Date: Mon, 15 Jan 2024 23:17:11 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-2a5" Expires: Wed, 14 Feb 2024 23:17:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f762d56afc88f7f52f51da3b63ad4658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: dBHpRz9LPZzsF5czz3o9LAVj8CP2qgY59IVmAptE1ElCNnh32-AhVw== Age: 1
2024-01-15 23:17:12 UTC	677	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 30 08 03 00 00 00 85 42 cc d9 00 00 00 7e 50 4c 54 45 b5 1e 30 ff ff ff d2 78 84 e1 a5 ac bd 35 45 f1 d4 d7 e9 bc c0 b4 1f 30 ff ff ff 3c 3a 70 d0 73 7d ec c7 cb e3 ab b1 48 46 79 54 53 82 64 4f 7a be 3b 4a be 3b 49 6d 6b 94 61 5f 8b 9d 9c b7 79 77 9d c2 c2 d2 b6 b5 c9 ce ce db 85 84 a6 f3 f3 f6 96 27 41 e7 e7 ed da da e4 aa a9 c0 91 90 ae 6d 6b 93 91 90 af 85 83 a5 60 5f 8b 91 91 ae ab 64 7b c0 a3 b4 92 90 af bc 96 a8 a7 40 56 35 ed 65 0d 00 00 00 07 74 52 4e 53 9f 9f 9f 9f 9f 9f 9f 76 87 ee e5 00 00 01 cf 49 44 41 54 48 c7 cd 94 c9 72 dc 30 0c 44 e5 25 b1 68 1b 48 c2 75 a8 68 b1 66 b2 fe ff 0f 1a 68 ba 6c 97 7d 10 55 c5 83 fa f0 8a a7 26 d1 20 d0 99 0a fd bc db 54 27 46 6c 8d 88 40 f3 Data Ascii: PNGIHDRH0B~PLTE0x5E0<:ps}HFyTSdOz;J;Imka_yw'Amk`_d{@V5etRNSvIDATHr0D%hHuhfhl}U& T'Fl@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.5	50668	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	599	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://join.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	370	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:12 GMT Content-Type: application/json Content-Length: 81 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8461d4b12ba907df-IAD
2024-01-15 23:17:12 UTC	81	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 44 43 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"DC","stateName":"District of Columbia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.5	50669	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	663	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BasicSetupEmptyState.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	528	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1878 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:01 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:17:14 GMT ETag: "05c42f2f2cc422feb81862208c26899f" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 d01a0cfc47d6e412dd81c986ff5d69da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: zCETP04Cp-s95pNFE-rIveVo6cQero0bB6ZXOuUYmpBqrbGYzdIvFQ== Vary: Origin
2024-01-15 23:17:13 UTC	1878	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 b7 50 4c 54 45 4c 69 71 b9 d1 fc ba d1 fc ba d1 fc ba d1 fa 00 1c 58 ba d1 fc ba d1 ff b9 d0 fb 01 1d 58 5b 3f 40 ba d2 fb 00 1c 57 00 1c 57 00 1c 58 02 1e 59 00 1c 57 ff 85 0b ba d1 fb 00 1c 57 00 1b 57 00 1d 58 ba d1 fc ff 7f 00 ff 80 00 ba d1 fb ba d1 fb ff 80 00 ff 80 00 8a a3 d1 a8 be e6 ff ff ff ba d1 fc ff 80 00 00 1d 58 f9 fb ff e1 eb fe ef f4 fe c5 d9 fd bd d3 fc d1 e0 fd d7 e4 fd ff cd 9a ff f8 ef ff ba 74 18 33 6b ff 9c 39 ff ab 57 ff 91 22 82 9b cb ff de bb ff ec d8 6c 7f a8 d7 db e5 39 51 81 a4 bc e9 2e 48 7c a1 ac c2 4f 65 93 52 6d a1 b4 bd ce aa f3 27 9e 00 00 00 1f 74 52 4e 53 00 63 74 d9 31 98 cb 10 f5 45 08 42 ef 5a 15 c6 79 fd 99 Data Ascii: PNGIHDRxxPLTELiqXX[?@WWXYWWWXXt3k9W"l9Q.H\|OeRm'tRNSct1EBZy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.5	50670	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	651	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Websites.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	527	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 917 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:02 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:17:14 GMT ETag: "1dc79937e26730d866e5f2bb75b34417" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 ec809871438c11b540493503de981368.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: U2DVrnT_5ne_NbhEntSPVXdNd2inwi2qHLp1up_AnxAHRuPwe6upXg== Vary: Origin
2024-01-15 23:17:13 UTC	917	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 70 00 00 00 78 08 03 00 00 00 1d 6d 86 14 00 00 00 63 50 4c 54 45 4c 69 71 03 1d 55 02 1d 54 02 1d 55 be d1 f8 03 1d 55 00 1e 55 02 1d 55 be d0 f8 03 1e 55 02 1d 54 a6 bf f5 9b b7 f3 90 af f2 b2 c7 f7 69 87 c5 be d1 f8 91 b0 f2 03 1e 55 b3 c9 f7 9b b8 f4 ff ff ff 58 76 b3 7f 9e df ff 87 0a d0 de fa fb fd ff f8 90 26 c9 c5 d0 e3 a7 72 34 51 8b d4 b9 a9 d6 b6 a1 67 53 c7 53 00 00 00 10 74 52 4e 53 00 34 9c c2 bc e8 16 77 dd 4b 5c 1f 90 dd 4d d5 71 8a 6b 4c 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 02 bc 49 44 41 54 78 9c ed 9a db 92 a3 20 10 40 05 d2 30 9a cb 2a b0 33 66 92 99 cc ff 7f e5 96 a2 89 26 68 48 a4 bb 66 53 9c f2 25 3e 70 aa 2f 52 15 e8 2c 4b 24 12 bf 15 29 a5 a4 Data Ascii: PNGIHDRpxmcPLTELiqUTUUUUUTiUXv&r4QgSStRNS4wK\MqkLpHYsIDATx @0*3f&hHfS%>p/R,K$)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.5	50671	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	658	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/CustomerSupport.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	510	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1525 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:02 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:17:12 GMT ETag: "a46b40cc66dfc5d0fd0ec67789ff9170" X-Cache: Hit from cloudfront Via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: cUvgbmxR_YfKeyAIOUYSLkKYrNAZzqT2PfRxxC3ua7539nMhVTivnw== Age: 76992 Vary: Origin
2024-01-15 23:17:12 UTC	1525	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 78 08 03 00 00 00 aa d0 7e 33 00 00 00 d2 50 4c 54 45 4c 69 71 02 1d 55 03 1d 55 bc cf f6 02 1d 55 02 1d 54 03 1d 54 03 1d 55 00 1e 55 79 7c a0 02 1e 55 94 5a 29 02 1d 55 be d1 f8 be d1 f8 02 1d 54 04 1d 55 03 1d 55 01 1e 54 bd d1 f8 be d1 f8 be d2 f9 be d1 f8 fe 86 09 79 8f bc be d1 f8 be d1 f7 be d0 f8 f5 82 0c 28 2a 4d ff 86 09 f7 83 0b ff 87 0a ac c0 e9 ff 86 09 ff 87 0a ff 87 0a 67 60 70 fc 85 0b ff 86 09 b0 c4 eb 9b ab ce 03 1e 55 be d1 f8 ff ff ff ff 87 0a 56 40 3c 24 3d 6f f5 f7 fb 16 2f 63 09 23 58 d7 e3 fb e5 ea f3 4c 61 8b d5 d9 e3 3b 52 80 8c 9e c4 7f 8c a8 b5 bd cd a4 ae c2 d6 76 16 cb db fa 5f 71 98 1f 29 4d 6e 82 ab b6 68 1f 8a 56 2c 6e 4a 35 7f 52 30 a2 b7 e0 4d d2 ff 13 Data Ascii: PNGIHDR[x~3PLTELiqUUUTTUUy\|UZ)UTUUTy(*Mg`pUV@<$=o/c#XLa;Rv_q)MnhV,nJ5R0M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.5	50673	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	655	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/BoardChartUp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	532	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 561 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:01 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 19:06:29 GMT ETag: "c56550144e45b5ba82b2520f84bf24b7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: 2J3dEF2PXiaFh4dV1sN0akmTWdqNBvf3QQWJuSiQB3NHdLL29mI5Xw== Age: 15044 Vary: Origin
2024-01-15 23:17:12 UTC	561	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5d 00 00 00 78 08 03 00 00 00 a7 ce 0e 74 00 00 00 54 50 4c 54 45 4c 69 71 07 20 57 1f 35 67 02 1d 55 02 1e 55 03 1d 54 04 1d 53 bd d1 f7 bf d2 f7 02 1d 55 be d1 f8 bd d0 f8 59 70 a0 2b 44 78 be d1 f8 03 1e 55 ff ff ff ff 87 0a 35 4e 80 e9 ef fd f4 f7 fe e3 a8 74 b2 c8 f7 96 b3 f3 f1 96 3c a4 be f5 d8 e3 fb c4 ca e2 cf db 09 f1 00 00 00 0e 74 52 4e 53 00 3f 13 d0 ab ed 2a 85 44 66 bc 36 86 a3 01 9e c2 a3 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 01 69 49 44 41 54 78 9c ed d9 61 6f 82 30 10 c6 f1 82 b4 8a ba b2 0d bd db b1 ef ff 3d 97 2a d1 0a 25 71 ee 39 97 65 f7 7f 61 f0 cd 8f e6 52 89 5a e7 2c cb b2 2c eb c7 d5 c1 29 56 ad 4c 2f 57 79 a7 58 80 eb b5 af ae d7 2d 5a 77 6d Data Ascii: PNGIHDR]xtTPLTELiq W5gUUTSUYp+DxU5Nt<tRNS?Df6pHYsiIDATxao0=%q9eaRZ,,)VL/WyX-Zwm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.5	50674	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	657	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/ChannelManager.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:12 UTC	533	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1113 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:01 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 19:06:29 GMT ETag: "e52554235b2e8390dd41afcc3e7457b2" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f18ca2e5109f8aa7cd1212932dc4e9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: UvbYedzRsuffvJrSdcrca2xbc9sUg_Qmn5OTxZIQWExZMXkJA_-W6A== Age: 15044 Vary: Origin
2024-01-15 23:17:12 UTC	1113	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 92 00 00 00 78 08 03 00 00 00 2e 7a 5b 58 00 00 00 8a 50 4c 54 45 4c 69 71 02 1e 55 03 1e 55 00 1d 58 be d2 f8 02 1d 55 02 1e 55 be d1 fa 03 1e 54 be d2 f8 bc cf f7 02 1d 55 be d0 f5 ff 88 09 02 1e 55 be d1 f8 ff 86 09 fd 8a 15 00 1e 55 03 1d 55 03 1c 54 be d1 f8 be d0 f5 ff 87 08 ff 86 09 03 1e 55 ff 87 09 be d1 f7 02 1d 55 be d1 f7 ff 87 09 43 38 40 42 38 41 df a4 7d be d1 f8 ff 87 0a 03 1e 55 b1 c8 f7 ff ff ff 9d b9 f4 97 b5 f3 db e5 fc d9 b3 98 ed f3 fd ce c0 c0 ea 9f 57 6c a9 4b c2 00 00 00 22 74 52 4e 53 00 dc 3a 0f 77 a9 65 0c 89 65 3d c4 fc 1e 4f ca d5 f6 1b e7 2c 9d ed 45 70 f4 8a 8c 78 ad ab ad ac 55 93 a9 04 54 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 47 49 Data Ascii: PNGIHDRx.z[XPLTELiqUUXUUTUUUUTUUC8@B8A}UWlK"tRNS:wee=O,EpxUTpHYsGI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.5	50672	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	651	OUT	GET /design-assets/assets/v3.109.0/illustrations-partner-thumbnails/Document.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	527	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 630 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:02 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Mon, 15 Jan 2024 23:17:14 GMT ETag: "63b6187ce089a07d285d837208370f19" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 ec8b1bfbf511818c606f196b49f871e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: I5eLn1c4jO4A6RN3GFiyJsHAjzC99NmLYx6JhyI1y2GSdTeZO2-EkA== Vary: Origin
2024-01-15 23:17:13 UTC	630	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 47 00 00 00 78 08 03 00 00 00 97 42 1f 55 00 00 00 69 50 4c 54 45 4c 69 71 03 1d 55 02 1d 54 02 1d 54 be d0 f7 07 21 58 00 1d 54 bd d0 f7 bd d1 f8 be d2 fa 03 1d 54 88 9d c7 b7 cb f3 bd d1 f9 bd d0 f7 ff ff ff be d1 f8 03 1e 55 e1 e9 fc ff 88 0b e9 ef fd a7 c0 f5 cd db f8 98 b5 f3 f0 f4 fc b6 ca f6 35 4c 79 ff 9a 31 24 3b 6c ff e0 c0 ff b0 5c 65 79 a3 aa bb de e4 ec fc ff d7 ad ef 46 2f bf 00 00 00 0f 74 52 4e 53 00 9d c7 79 cc f3 1f f3 71 32 4a fa b8 53 6d 6f 53 09 0c 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 01 98 49 44 41 54 78 9c ed 98 d1 72 82 30 10 45 23 31 54 01 1b 16 d3 34 a0 02 f6 ff 3f b2 43 51 08 8d 01 43 32 42 3b 39 4f ce 90 39 ec de 5d 79 08 42 7f 8e d0 85 04 Data Ascii: PNGIHDRGxBUiPLTELiqUTT!XTTU5Ly1$;l\eyF/tRNSyq2JSmoSpHYsIDATxr0E#1T4?CQC2B;9O9]yB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.5	50675	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:12 UTC	607	OUT	GET /cdata/joinapp/meet_patricia.jpg HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	552	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 45764 Connection: close Date: Wed, 03 Jan 2024 23:16:19 GMT Last-Modified: Wed, 12 Apr 2023 15:37:14 GMT ETag: "389f437a3bc267bd2b48bca42ab30e1f" x-amz-server-side-encryption: AES256 x-amz-version-id: P_zLNpnKTNNmZ7PWKXM3_7cJGmIzZEPV Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 966a4e45512437c14125c564c492a2d6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD50-C2 X-Amz-Cf-Id: PFX1lWhrb3EDwYB84ZYvhGOngcEsoBh4SQc42KEJbaRxVW563o3f6Q== Age: 1036855
2024-01-15 23:17:13 UTC	15832	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 03 1e 03 20 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff c4 00 19 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f4 3c 3b 00 00 00 00 00 Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)================================================== <;
2024-01-15 23:17:13 UTC	16384	IN	Data Raw: a5 29 78 e2 6d e5 a1 a5 3e c5 b7 92 48 c3 17 91 55 09 6b 62 39 d4 e4 7f 38 48 5c 4f 93 0a 62 e4 cf a5 e4 6c 6b 3b 16 70 74 1d c9 c9 32 57 e8 25 97 39 7b 46 7b 75 21 06 28 e2 1a e3 87 5c 71 d4 eb fb 75 72 6a 11 d9 ea 02 c6 83 6e 10 73 79 bc 1f c1 1f c6 3e c3 d8 fb 2f f5 1f e9 63 a5 f5 34 fd 61 e3 22 dd be 73 45 ca f6 55 25 26 f4 f7 21 f4 77 89 f8 a1 63 c6 f0 b8 d4 cb de 2d 34 6c 23 db 35 33 2e 0e 25 f2 3e 18 76 5e 24 0c 4e 30 0c 35 82 01 16 c2 47 f2 83 aa b3 f5 17 2c 69 27 71 23 f4 d6 1f d9 db 59 3b e5 c9 76 b6 66 11 40 fb 6b 30 01 b4 1a 48 5f a5 59 3e 60 90 f5 8b 4c d5 fa f5 b7 14 a7 38 d5 fb 14 6c 7f a9 38 70 7b 1f 65 fd 37 3a 4f 51 cf d9 b8 dd 89 79 06 32 19 13 35 f7 cf d8 2f 0b c9 0e 46 91 3d 0f 1f 38 92 18 db 62 7a f9 12 00 a8 02 e0 63 89 bc 1b ce e4 Data Ascii: )xm>HUkb98H\Oblk;pt2W%9{F{u!(\qurjnsy>/c4a"sEU%&!wc-4l#53.%>v^$N05G,i'q#Y;vf@k0H_Y>`L8l8p{e7:OQy25/F=8bzc
2024-01-15 23:17:13 UTC	13548	IN	Data Raw: 1b 5b 32 9b 63 ce 8c f6 38 8d 28 d9 dc 73 32 94 50 fa f1 58 68 da de e2 28 2c 03 50 b1 2a e5 74 f3 f7 0c 3c 6f 8e e6 57 48 20 5f 2b 8a 08 fb 33 20 07 71 00 f2 16 7e 62 15 fb 39 0d 4c 86 fa 98 0f 99 fd a2 b7 42 8b 0e 27 f0 bd 08 d4 76 26 31 5f 38 f8 7e d5 ea f9 46 56 1b 88 22 9b e3 7c 8f 0d a1 e1 b7 0b 27 7e 1a ae 6a 8d 63 66 15 07 a0 a9 ad be ce f3 d2 58 fe 9a 51 84 df 87 61 1c ff 00 8c 7f 26 37 1b cc 83 09 83 e3 34 f2 d4 01 8a c3 9b 1a 31 72 1e 82 30 3c c8 8d 2c 9b 20 c3 af 9b d1 8c 10 50 ab 02 fa c7 cd 99 c2 af 32 4f 49 dc f0 1e be 71 32 b3 82 a9 63 1a fa 43 87 10 bc 8d e2 3e 86 05 10 9f 7f d3 eb 07 c8 81 2d 09 53 e9 06 2c e6 9a 05 3f 41 f8 4d f8 9b e4 21 f2 09 2f cc c6 cd e5 6b 0b 4c 99 ba e9 22 76 73 e6 4c 23 f1 98 fc f7 fd 22 64 eb 68 20 6e ab bc c5 Data Ascii: [2c8(s2PXh(,P*t<oWH _+3 q~b9LB'v&1_8~FV"\|'~jcfXQa&741r0<, P2OIq2cC>-S,?AM!/kL"vsL#"dh n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.5	50639	18.164.96.33	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:13 UTC	3196	OUT	GET /js_tracking?ref_action=index&ver=2&stype=24&lang=en-us&pid=7a96a3baef7600d5&ete=&etg=&etcg=&ets=UETTJbZWMZfPAJNLJPGEbfWEBOWe\|1,UETTJbZWMZfPAJNLJPGEbfWEBOWe\|2,UETTJbZWMZfPAJNLJPGEbfWEBOWe\|8&etgwv= HTTP/1.1 Host: join.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EBTtW_UZL19CDVOFfUBkswvf6lksvC36y0djMbpAYWP7ZJiwTyE2VfxDgdfrbSMGZBPBe2MD_4ur1o44GsTgLb0N2qOHLWplP-iV-feec3Z9wm_l0ZS8WbQ3NMEyOfhxDS8XIqAD5CaM X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 7a96a3baef7600d5 X-Booking-Info: X-Booking-SiteType-Id: 24 X-Booking-Session-Id: sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://join.booking.com/?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaIwCiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAK4-ZatBsACAdICJGIwNzYwNjU2LTczOTItNDAzYy05NGJjLTliY2Q2ZDI5MWFiNtgCBeACAQ&lang=en-us&sid=94b76ea7cb923e6da206675b5d1abbbd&utm_medium=frontend&utm_source=topbar Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; _ga=GA1.2.810723182.1705360577; esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D; slan=xu; lastSeen=1705360632126
2024-01-15 23:17:13 UTC	426	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Mon, 15 Jan 2024 23:17:13 GMT strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 68f2eed06d7ecb02b863cacb0da2fc28.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P5 X-Amz-Cf-Id: NEy3mNtnUNR-kYbALjZ3fr6Wf0b1SdGsMpEm0qwR78LgBloO37-Q1w==
2024-01-15 23:17:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.5	50677	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:13 UTC	639	OUT	GET /consent/501b35ec-1330-4a3f-9287-1f5f727b0f3d/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://join.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	901	IN	HTTP/1.1 200 OK Date: Mon, 15 Jan 2024 23:17:13 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8461d4b7c8ee2430-IAD CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 8049 Cache-Control: public, max-age=86400 Expires: Tue, 16 Jan 2024 23:17:13 GMT Last-Modified: Thu, 31 Aug 2023 13:58:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: weTGlqKAkOTdeCPNE1/3dg== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 76c45881-901e-0094-16d5-128eea000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-01-15 23:17:13 UTC	468	IN	Data Raw: 37 63 31 64 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c1d{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage your
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 69 Data Ascii: iesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActi
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b 69 65 20 70 72 65 66 65 72 65 6e 63 65 73 22 2c 22 50 72 65 66 65 72 65 6e 63 Data Ascii: ttom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage cookie preferences","Preferenc
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 67 65 2c 20 70 61 73 74 20 73 Data Ascii: l cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selected currency, language, past s
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 32 37 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 66 66 5f 64 64 74 63 22 2c 22 48 6f 73 74 22 3a 22 6a 6f 69 6e 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 64 20 62 79 20 50 65 72 69 6d 65 74 65 72 58 20 74 6f 20 64 65 74 65 63 74 20 66 72 61 75 64 20 61 6e 64 20 62 6f 74 20 61 63 74 69 76 69 74 79 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 Data Ascii: 27","Name":"_pxff_ddtc","Host":"join.booking.com","IsSession":false,"Length":"0","description":"Used by PerimeterX to detect fraud and bot activity.","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"t
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 2e 20 54 68 69 73 20 65 6e 61 62 6c 65 73 20 73 69 74 65 20 6f 77 6e 65 72 73 20 74 6f 20 70 72 65 76 65 6e 74 20 63 6f 6f 6b 69 65 73 20 69 6e 20 65 61 63 68 20 63 61 74 65 67 6f 72 79 20 66 72 6f 6d 20 62 65 69 6e 67 20 73 65 74 20 69 6e 20 74 68 65 20 75 73 65 72 73 20 62 72 6f 77 73 65 72 2c 20 77 68 65 6e 20 63 6f 6e 73 65 6e 74 20 69 73 20 6e 6f 74 20 67 69 76 65 6e 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 61 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 Data Ascii: . This enables site owners to prevent cookies in each category from being set in the users browser, when consent is not given. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 20 6d 61 6c 69 63 69 6f 75 73 20 76 69 73 69 74 6f 72 73 20 61 6e 64 20 70 72 65 76 65 6e 74 69 6e 67 20 66 72 61 75 64 2e 20 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 32 65 39 61 34 38 31 35 2d 62 38 38 63 2d 34 33 37 38 2d 61 34 61 32 2d 34 34 37 32 62 33 66 31 37 61 38 66 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 64 65 22 2c 22 48 6f 73 74 22 3a 22 62 Data Ascii: malicious visitors and preventing fraud. ","DurationType":1,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"2e9a4815-b88c-4378-a4a2-4472b3f17a8f","Name":"_pxde","Host":"b
2024-01-15 23:17:13 UTC	1369	IN	Data Raw: 20 74 6f 20 73 74 6f 72 65 20 63 75 72 72 65 6e 74 20 73 65 73 73 69 6f 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 68 20 61 73 20 62 6f 6f 6b 69 6e 67 20 73 74 61 74 75 73 2c 20 68 6f 74 65 6c 20 62 65 69 6e 67 20 6c 6f 6f 6b 65 64 20 61 74 2c 20 6c 6f 63 61 6c 65 20 65 74 63 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 33 36 35 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 69 64 22 3a 22 39 39 34 61 33 66 35 Data Ascii: to store current session information such as booking status, hotel being looked at, locale etc","DurationType":365,"category":null,"isThirdParty":false},{"thirdPartyDescription":null,"patternKey":null,"thirdPartyKey":"","firstPartyKey":null,"id":"994a3f5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.5	50676	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:13 UTC	650	OUT	POST /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive Content-Length: 811 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://join.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-01-15 23:17:13 UTC	811	OUT	Data Raw: 70 61 79 6c 6f 61 64 3d 61 55 6b 51 52 68 41 49 45 47 4a 71 41 77 49 4b 41 77 51 51 48 68 42 57 45 41 68 4a 45 47 4a 71 41 77 49 42 42 41 49 51 43 42 42 61 52 6b 5a 43 51 51 67 64 48 56 68 64 57 31 77 63 55 46 31 64 57 56 74 63 56 52 78 52 58 56 38 64 44 56 4e 62 56 67 38 42 41 67 59 44 42 67 41 55 58 6c 4e 51 56 31 34 50 56 56 64 63 41 77 55 42 58 45 41 66 41 33 52 78 63 33 64 64 56 56 56 37 42 67 52 7a 56 6e 74 2f 41 31 56 33 55 33 74 46 63 56 74 7a 64 33 42 66 63 33 64 4b 52 33 4e 33 61 6b 74 7a 64 33 38 41 63 33 64 77 42 48 4e 33 63 42 39 7a 64 33 46 62 63 33 74 77 51 33 4e 37 64 6b 64 7a 65 51 59 66 61 46 4e 47 63 45 46 7a 63 58 4e 57 65 33 46 34 64 58 74 46 66 45 68 72 52 58 78 59 5a 77 42 2b 5a 6c 46 49 66 57 5a 37 52 6e 78 32 63 30 68 72 53 77 49 Data Ascii: payload=aUkQRhAIEGJqAwIKAwQQHhBWEAhJEGJqAwIBBAIQCBBaRkZCQQgdHVhdW1wcUF1dWVtcVRxRXV8dDVNbVg8BAgYDBgAUXlNQV14PVVdcAwUBXEAfA3Rxc3ddVVV7BgRzVnt/A1V3U3tFcVtzd3Bfc3dKR3N3aktzd38Ac3dwBHN3cB9zd3Fbc3twQ3N7dkdzeQYfaFNGcEFzcXNWe3F4dXtFfEhrRXxYZwB+ZlFIfWZ7Rnx2c0hrSwI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.5	50678	13.249.39.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:13 UTC	2487	OUT	GET /track_join_app_landing?progress_status=1 HTTP/1.1 Host: booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmPqjg1lv3bS7LPrL6oO2O918BWKe50abvUL4amb+AIduDjMJMJKqK04NNFuC/8YyfVewr0cqdYpZ5jt5+lipwSuWujbFQ8MN2BJ0y6TPrNWvrdd/vToK97s4KqYT9+m/DeKai+3KY; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dd5e1b3bb-d618-4215-97f8-7adbc3a7b35d%26consentedAt%3D2024-01-15T23%3A16%3A08.631Z%26expiresAt%3D2024-07-13T23%3A16%3A08.631Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DDC%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; BJS=-; _gid=GA1.2.1111547412.1705360577; _gat=1; bkng_sso_session=e30; bkng_sso_ses=e30; bkng_prue=1; _gcl_au=1.1.460620828.1705360583; __gads=ID=f927aa320290b431:T=1705360584:RT=1705360584:S=ALNI_MY-WLt4PifNWjZx0Ql0SjhTsLAvtQ; __gpi=UID=00000db788c26b0e:T=1705360584:RT=1705360584:S=ALNI_Ma9Wu5WaA2gn8uFUPPbfU7YMou_kA; _scid=63395ea6-3749-4b67-883b-6eaa54a6664d; FPID=FPID2.2.ZNFiMqqfT3b3TN8bbw%2BYyVuVEL3pcCjY96bR8R5Gu98%3D.1705360577; _pin_unauth=dWlkPVpHRTBNRFkwT0dJdFpEQmhaUzAwT0dSaExUazNOR010TmpWaFltWTBORFEwTTJSbQ; _sctr=1%7C1705359600000; FPLC=1Oqqq%2BzwiVyQKzeIUpQMIDdwulX4%2BS%2FjQsl31YSEiyY%2BGVABKDxeR2na2Fr4c4coVdqE6BVDc%2BYVgSxz5eRqWo8VhRczwBdGwfYROSCUEDMcr0I1NFm%2Fk8srQtjGIA%3D%3D; _ga_A12345=GS1.1.1705360585.1.1.1705360608.0.0.0; _scid_r=63395ea6-3749-4b67-883b-6eaa54a6664d; _ga_FPD6YLJCJ7=GS1.1.1705360585.1.1.1705360608.37.0.0; _uetsid=1af64d70b3fc11ee9591dfabbb6c1e0c; _uetvid=1af73e00b3fc11eeaf58618c9b35d68e; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBvsU%2Fjc6fIhdUUwypgnXprdgiKXlOVifArrpi448WS%2BiX1wNBINZXnb5ftH55WCKxkEI3qjlKpZvBCBnpLw3lMKkVoTf40szCBK9XvwkKG6%2Fn59odk8mXN7irebcjzigbTj4h%2FPy7Ns%2BB9JgOyzjGSMWvEeziR601c%3D; _ga=GA1.2.810723182.1705360577; esadm=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKCt6V9CGpj2hb3CHML8cKsmgEKeiAlzyA%3D; he=02UmFuZG9tSVYkc2RlIyh9YbxZGyl9Y5%2BPqAmo9ogAWaKOdbkEZ19unmdPf1JIL52O7dOenGNxd3s%3D; lastSeen=1705360632126

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.5	50679	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-15 23:17:13 UTC	607	OUT	GET /static/img/join/world-map-gray.png HTTP/1.1 Host: q.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://join.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.5	50680	18.164.96.33	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.5	50683	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.5	50684	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.5	50685	104.18.32.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.5	50691	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.5	50687	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.5	50688	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.5	50689	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.5	50690	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.5	50692	104.18.131.236	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.5	50686	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.5	50693	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.5	50694	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.5	50695	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.5	50696	99.84.191.14	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.5	50698	52.85.132.107	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.5	50697	13.249.39.37	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.5	50699	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.5	50701	99.84.191.14	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.5	50700	142.251.111.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.5	50704	142.251.163.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.5	50707	172.253.115.147	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.5	50705	74.119.119.142	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.5	50706	142.251.16.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.5	50709	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.5	50710	142.251.111.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.5	50711	172.253.115.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.5	50713	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.5	50712	142.251.167.99	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.5	50708	172.253.62.148	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.5	50714	142.251.16.149	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.5	50715	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.5	50717	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.5	50718	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.5	50719	172.253.62.154	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.5	50720	74.119.119.71	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.5	50721	74.119.119.74	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.5	50725	23.209.60.28	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.5	50731	147.135.94.221	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.5	50730	35.71.139.29	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.5	50724	68.67.160.76	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.5	50723	35.211.178.172	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.5	50726	3.224.246.109	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.5	50728	141.226.224.48	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.5	50733	74.119.119.71	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.5	50732	74.119.119.71	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.5	50735	3.224.246.109	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.5	50736	68.67.160.76	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.5	50737	195.244.31.10	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.5	50734	35.211.178.172	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.5	50746	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.5	50743	23.105.12.121	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.5	50738	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.5	50740	34.200.65.202	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.5	50747	104.18.36.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.5	50744	13.225.195.71	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.5	50748	35.71.139.29	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.5	50749	52.85.132.12	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.5	50745	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.5	50742	141.226.224.48	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.5	50750	18.164.96.33	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.5	50752	34.200.65.202	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.5	50759	104.18.36.155	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.5	50756	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.5	50753	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.5	50751	68.67.160.24	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.5	50758	44.215.44.145	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.5	50757	3.90.211.105	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.5	50765	35.211.178.172	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.5	50764	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.5	50766	23.222.200.28	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.5	50768	52.85.132.30	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.5	50769	35.71.139.29	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.5	50770	3.224.246.109	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.5	50761	54.224.27.48	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.5	50763	52.40.188.60	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.5	50775	44.215.44.145	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.5	50774	3.90.211.105	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.5	50754	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.5	50776	3.227.14.209	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.5	50778	8.28.7.83	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.5	50783	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.5	50782	52.85.132.125	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.5	50780	52.6.62.160	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.5	50777	3.226.158.19	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.5	50784	35.190.10.96	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.5	50779	50.31.142.223	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.5	50785	34.200.65.202	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.5	50786	74.119.119.150	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
926	192.168.2.5	50787	68.67.160.76	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
927	192.168.2.5	50788	18.67.76.69	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
928	192.168.2.5	50789	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
929	192.168.2.5	50790	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
930	192.168.2.5	50791	35.190.43.134	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
931	192.168.2.5	50792	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
932	192.168.2.5	50793	3.226.158.19	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
933	192.168.2.5	50797	172.64.151.101	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
934	192.168.2.5	50798	34.200.65.202	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
935	192.168.2.5	50796	3.234.138.61	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
936	192.168.2.5	50802	3.227.14.209	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
937	192.168.2.5	50803	8.28.7.83	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
938	192.168.2.5	50801	35.171.143.90	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
939	192.168.2.5	50739	23.58.127.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
940	192.168.2.5	50804	34.235.32.60	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
941	192.168.2.5	50806	3.224.246.109	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
942	192.168.2.5	50807	3.90.211.105	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
943	192.168.2.5	50809	34.195.167.11	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
944	192.168.2.5	50805	50.31.142.191	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
945	192.168.2.5	50810	3.231.143.26	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
946	192.168.2.5	50811	68.67.179.87	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
947	192.168.2.5	50813	34.195.167.11	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
948	192.168.2.5	50815	35.71.131.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
949	192.168.2.5	50816	3.233.89.241	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
950	192.168.2.5	50817	74.119.119.139	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
951	192.168.2.5	50819	54.88.49.220	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
952	192.168.2.5	50818	35.71.131.137	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
953	192.168.2.5	50821	54.172.56.55	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
954	192.168.2.5	50820	52.86.139.62	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
955	192.168.2.5	50808	23.58.127.113	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
956	192.168.2.5	50822	3.224.246.109	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
957	192.168.2.5	50823	52.86.139.62	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
958	192.168.2.5	50824	13.249.39.110	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
959	192.168.2.5	50812	23.58.127.72	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
960	192.168.2.5	50825	51.222.241.145	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
961	192.168.2.5	50829	74.119.119.131	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
962	192.168.2.5	50828	23.58.127.72	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
963	192.168.2.5	50830	13.249.39.128	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
964	192.168.2.5	50831	52.223.40.198	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
965	192.168.2.5	50833	172.253.122.156	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
966	192.168.2.5	50834	3.162.103.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
967	192.168.2.5	50835	3.162.103.47	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
968	192.168.2.5	50838	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
969	192.168.2.5	50837	3.162.103.80	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
970	192.168.2.5	50839	34.206.227.189	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
971	192.168.2.5	50841	68.67.179.87	443	4984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.5	50843	54.209.243.229	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.5	50844	54.209.243.229	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.5	50846	54.157.70.26	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.5	50848	216.239.34.21	443

Timestamp	Bytes transferred	Direction	Data

Target ID:	0
Start time:	00:15:57
Start date:	16/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:16:01
Start date:	16/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,16912180351865998233,6883049137768924135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:16:05
Start date:	16/01/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.com-find-book.com/p/6797383828
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://booking.com-find-book.com/p/6797383828

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 298

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 301

Chrome Cache Entry: 302

Windows Analysis Report
https://booking.com-find-book.com/p/6797383828